CVE-2026-116183: phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID

Q: What must an attacker do to exploit this issue?

The attacker can be unauthenticated but must solve the CAPTCHA and submit a POST request to /api/faq/create with an arbitrary openQuestionID. No existing account or prior authorization is required.

Q: Which deployments are exposed?

phpMyFAQ versions before 4.1.10 are affected. The vulnerable endpoint can allow modification or deletion of visitor questions when reachable by an attacker who can complete the CAPTCHA.

Q: When can questions be permanently deleted?

Permanent deletion is possible when the records.enableDeleteQuestion setting is enabled. Even where deletion is not enabled, an attacker may rewrite question categories or forge answered entries in faqquestion_history.

Published Oct 25, 2026

Updated

phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestionhistory, or permanently delete questions when records.enableDeleteQuestion is enabled.

Affected Software

1 affected component

PhpMyFaq phpmyfaq<4.1.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade phpMyFAQ to a version that resolves this vulnerability.
Fixed in 4.1.10

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker can be unauthenticated but must solve the CAPTCHA and submit a POST request to /api/faq/create with an arbitrary openQuestionID. No existing account or prior authorization is required.

Which deployments are exposed?

phpMyFAQ versions before 4.1.10 are affected. The vulnerable endpoint can allow modification or deletion of visitor questions when reachable by an attacker who can complete the CAPTCHA.

When can questions be permanently deleted?

Permanent deletion is possible when the records.enableDeleteQuestion setting is enabled. Even where deletion is not enabled, an attacker may rewrite question categories or forge answered entries in faqquestion_history.

CVE-2026-116183: phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

Which deployments are exposed?

When can questions be permanently deleted?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Which deployments are exposed?

When can questions be permanently deleted?