CVE-2026-111907: phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database
phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.9
Event History
Frequently Asked Questions
Who can be targeted by this vulnerability?
An attacker can target a user who is currently logged in to phpMyFAQ and has the CONFIGURATION_EDIT permission. The attack requires luring that user into submitting a crafted cross-site request.
Are unauthenticated attackers able to trigger database migrations directly?
The attacker does not need phpMyFAQ credentials, but exploitation depends on the victim being authenticated and authorized with CONFIGURATION_EDIT. User interaction is required to submit the crafted request.
Which deployments are affected?
phpMyFAQ versions from 4.0.0 before 4.1.9 are affected. The vulnerable endpoint is POST /admin/api/update-database.
What is the potential impact of successful exploitation?
Successful exploitation triggers database migrations. This may affect database integrity or availability; confidentiality impact is not indicated.