# CVE-2026-111884: phpMyFAQ account takeover via unauthenticated email change

Source: https://junglewise.ai/threats/cve-2026-111884-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111884 · Severity: high · CVSS 8.3 · Published 2026-10-17

phpMyFAQ is a frequently-asked-questions system that manages user accounts and access control. When a user with a hijacked session changes their account email address, the system does not verify the user's current password, allowing an attacker to redirect password-reset emails to an attacker-controlled address and take over the account. This completely bypasses security protections for accounts without two-factor authentication, including administrator accounts.

Technologies: [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-111884 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111884 being exploited in the wild.

**How severe is CVE-2026-111884?** High severity, with a CVSS score of 8.3, published 17 October 2026.

**Which products and versions are affected?** Thorsten phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.

**Is there a fix for CVE-2026-111884?** Yes: fixed in 4.1.9, 4.2.0-beta. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111884 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111884?** Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.1.9, 4.2.0-beta

## Technical details

The vulnerability exists in UserController::updateData (api/user/data/update) where email changes require only a valid session and CSRF token, unlike password changes which demand current-password verification. An attacker with a stolen session can change the victim's registered email, then exploit the password-reset flow (which sends the reset link to the new email) to set a new password and achieve account takeover. The flaw circumvents the protections added by GHSA-6r2c-694w-24qv.

## Affected products

- thorsten phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta

## Timeline

- 2026-10-17: disclosed

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7554-gx6g-xx77](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7554-gx6g-xx77)
- [https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-missing-current-password-step-up-on-e-mail-change-enables-account-takeover](https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-missing-current-password-step-up-on-e-mail-change-enables-account-takeover)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)