CVE-2026-111908: phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global editfaq permission and does not verify access to the target FAQ. Authenticated users with editfaq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user must have the global edit_faq permission. The flaw allows such a user to modify a restricted FAQ even when they do not have permission to view that specific FAQ.
What access does an attacker need to abuse the vulnerable endpoint?
The attacker needs valid authentication and the edit_faq permission, then can send a PUT request to /api/v3.1/faq/update with the ID of a restricted target FAQ. No user interaction is required.
What could an unauthorized editor change?
They can modify the restricted FAQ's content, bypass moderation, and change its publication state.
Which releases are affected?
Affected releases are phpMyFAQ 4.0.0 through versions before 4.1.9, and 4.2.0-alpha through versions before 4.2.0-beta.