Is CVE-2026-111884 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111884 being exploited in the wild.

How severe is CVE-2026-111884?

High severity, with a CVSS score of 8.3, published 17 October 2026.

Which products and versions are affected?

Thorsten phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.

Is there a fix for CVE-2026-111884?

Yes: fixed in 4.1.9, 4.2.0-beta. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111884 attacked?

It is attacked over the network.

Am I affected by CVE-2026-111884?

Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111884: phpMyFAQ account takeover via unauthenticated email change

CVE-2026-111884 · Severity: high · CVSS 8.3 · Published 2026-10-17

phpMyFAQ is a frequently-asked-questions system that manages user accounts and access control. When a user with a hijacked session changes their account email address, the system does not verify the user's current password, allowing an attacker to redirect password-reset emails to an attacker-controlled address and take over the account. This completely bypasses security protections for accounts without two-factor authentication, including administrator accounts.

Technologies: Thorsten phpMyFAQ. Vendors: Thorsten.

Quick answers

Is CVE-2026-111884 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111884 being exploited in the wild.
How severe is CVE-2026-111884?: High severity, with a CVSS score of 8.3, published 17 October 2026.
Which products and versions are affected?: Thorsten phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.
Is there a fix for CVE-2026-111884?: Yes: fixed in 4.1.9, 4.2.0-beta. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111884 attacked?: It is attacked over the network.
Am I affected by CVE-2026-111884?: Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.1.9, 4.2.0-beta

Technical details

The vulnerability exists in UserController::updateData (api/user/data/update) where email changes require only a valid session and CSRF token, unlike password changes which demand current-password verification. An attacker with a stolen session can change the victim's registered email, then exploit the password-reset flow (which sends the reset link to the new email) to set a new password and achieve account takeover. The flaw circumvents the protections added by GHSA-6r2c-694w-24qv.

Affected products

thorsten phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta

Timeline

2026-10-17: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.