CVE-2026-49205: phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
Missing Authorization in API CategoryController — CVE-2026-24421 fixed BackupController by adding userHasPermission(PermissionType::BACKUP). The same fix was NOT applied to 4 other write endpoints in the public API. All 4 only call hasValidToken() (shared API key) but never call userHasPermission(), allowing any API token holder to perform admin operations regardless of their user permissions.
Summary
CVE-2026-24421 fixed BackupController by adding: $this->userHasPermission(PermissionType::BACKUP);
The same fix was NOT applied to 4 other write endpoints in the public API. All 4 only call $this->hasValidToken() — which checks a shared API key header, NOT the individual user's role permissions.
Affected Endpoints
1. src/phpMyFAQ/Controller/Api/CategoryController.php → create() POST /api/v4.0/category Missing: userHasPermission(PermissionType::CATEGORYADD) Any API token holder can create categories regardless of user role.
2. src/phpMyFAQ/Controller/Api/FaqController.php → create() POST /api/v4.0/faq Missing: userHasPermission(PermissionType::FAQADD) Any API token holder can create FAQ entries regardless of user role.
3. src/phpMyFAQ/Controller/Api/FaqController.php → update() PUT /api/v4.0/faq Missing: userHasPermission(PermissionType::FAQEDIT) Any API token holder can update any FAQ entry regardless of user role.
4. src/phpMyFAQ/Controller/Api/QuestionController.php → create() POST /api/v4.0/question Missing: permission check Any API token holder can create questions regardless of user role.
Root Cause
All 4 methods only call: $this->hasValidToken(); ← shared API key, not per-user
The fixed BackupController correctly calls: $this->userHasPermission(PermissionType::BACKUP);
PermissionType::CATEGORYADD, FAQADD, FAQEDIT all exist in src/phpMyFAQ/Enums/PermissionType.php — they just are not being used.
Fix
Add userHasPermission() before the logic in each method:
// CategoryController.create() $this->userHasPermission(PermissionType::CATEGORYADD);
// FaqController.create() $this->userHasPermission(PermissionType::FAQADD);
// FaqController.update() $this->userHasPermission(PermissionType::FAQEDIT);
Reporter
CONTACT Santhoshini Ganta Github:@santhoshinipayload Email: santhoshinive75@gmail.com LinkedIn: http://linkedin.com/in/santhoshini-g-1440621ba
Other sources
phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed this in the BackupController by adding: $this->userHasPermission(PermissionType::BACKUP). The same fix was not applied to 4 other write endpoints in the public API. All 4 only call $this->hasValidToken() — which checks a shared API key header, rather than the individual user's role permissions. The following APIs are affected: POST /api/v4.0/category (CategoryController::create), POST /api/v4.0/faq (FaqController::create), PUT /api/v4.0/faq (FaqController::update), and POST /api/v4.0/question (QuestionController::create). This issue has been fixed in version 4.1.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpmyfaq/phpmyfaqto a version that resolves this vulnerability.Fixed in 4.1.4 - Upgrade
Upgrade
composer/thorsten/phpmyfaqto a version that resolves this vulnerability.Fixed in 4.1.4 - Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.4 - Configuration
In src/phpMyFAQ/Controller/Api/CategoryController.php, update create() to call $this->userHasPermission(PermissionType::CATEGORY_ADD) before the method logic (currently only $this->hasValidToken() is called).
CategoryController::create (POST /api/v4.0/category) authorization check = add $this->userHasPermission(PermissionType::CATEGORY_ADD) before create logic; ensure it is checked in addition to $this->hasValidToken() - Configuration
In src/phpMyFAQ/Controller/Api/FaqController.php, update create() to call $this->userHasPermission(PermissionType::FAQ_ADD) before the method logic (currently only $this->hasValidToken() is called).
FaqController::create (POST /api/v4.0/faq) authorization check = add $this->userHasPermission(PermissionType::FAQ_ADD) before create logic; ensure it is checked in addition to $this->hasValidToken() - Configuration
In src/phpMyFAQ/Controller/Api/FaqController.php, update update() to call $this->userHasPermission(PermissionType::FAQ_EDIT) before the method logic (currently only $this->hasValidToken() is called).
FaqController::update (PUT /api/v4.0/faq) authorization check = add $this->userHasPermission(PermissionType::FAQ_EDIT) before update logic; ensure it is checked in addition to $this->hasValidToken() - Configuration
In src/phpMyFAQ/Controller/Api/QuestionController.php, update create() to add the missing user permission check before create logic (material states only $this->hasValidToken() is called for this write endpoint; the specific PermissionType for QuestionController::create is not explicitly named in the provided text).
QuestionController::create (POST /api/v4.0/question) authorization check = add $this->userHasPermission() for the appropriate permission type before create logic; ensure it is checked in addition to $this->hasValidToken()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49205?
The severity of CVE-2026-49205 is medium, rated at 6.5.
What type of vulnerability is CVE-2026-49205?
CVE-2026-49205 is a missing authorization vulnerability affecting phpMyFAQ.
How do I fix CVE-2026-49205?
To fix CVE-2026-49205, update to phpMyFAQ version 4.1.4 or later where the issue has been addressed.
Which endpoints are affected by CVE-2026-49205?
CVE-2026-49205 affects four write endpoints in the API CategoryController of phpMyFAQ.
Is CVE-2026-49205 related to any other vulnerabilities?
Yes, CVE-2026-49205 is related to CVE-2026-24421, which had an incomplete fix for similar authorization issues.