Is CVE-2026-111905 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111905 being exploited in the wild.

How severe is CVE-2026-111905?

Medium severity, with a CVSS score of 6, published 17 October 2026.

Which products and versions are affected?

Phpmyfaq 3.2.0 before 4.1.9; 4.2.0-alpha before 4.2.0-beta.

How is CVE-2026-111905 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111905?

Check whether you run Phpmyfaq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111905: phpMyFAQ insecure direct object reference in admin user API

CVE-2026-111905 · Severity: medium · CVSS 6 · Published 2026-10-17

phpMyFAQ is a frequently-asked-questions knowledge base system commonly used in business support portals. The admin REST API endpoint that retrieves user data exposes live TOTP two-factor authentication secrets without proper access controls, allowing delegated administrators to steal a SuperAdmin's 2FA credential and gain full account access, bypassing two-factor authentication entirely.

Technologies: Phpmyfaq. Vendors: Phpmyfaq.

Quick answers

Is CVE-2026-111905 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111905 being exploited in the wild.
How severe is CVE-2026-111905?: Medium severity, with a CVSS score of 6, published 17 October 2026.
Which products and versions are affected?: Phpmyfaq 3.2.0 before 4.1.9; 4.2.0-alpha before 4.2.0-beta.
Is there a fix for CVE-2026-111905?: Yes: fixed in phpMyFAQ 4.1.9, 4.2.0-beta. Until then: Restrict access to the /admin/api/user/data endpoint to SuperAdmin users only, or disable the endpoint until upgrading if user-management delegation is not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111905 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111905?: Check whether you run Phpmyfaq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: phpMyFAQ 4.1.9, 4.2.0-beta

Restrict access to the /admin/api/user/data endpoint to SuperAdmin users only, or disable the endpoint until upgrading if user-management delegation is not required.

Technical details

An insecure direct object reference (IDOR) vulnerability in GET /admin/api/user/data/{userId} returns the raw database row for any user, including the secret column containing the live TOTP seed, to any authenticated administrator holding user-management rights, without verifying that the acting user is a SuperAdmin or that the target is protected. An attacker with delegated admin privileges can enumerate arbitrary user IDs to extract a SuperAdmin's TOTP secret, then generate valid time-based one-time passwords to impersonate them. The vulnerability stems from the read endpoint's lack of the SuperAdmin/protected-target guard that the write sibling endpoints (editUser, deleteUser, etc.) all implement.

Affected products

phpMyFAQ phpMyFAQ 3.2.0 before 4.1.9; 4.2.0-alpha before 4.2.0-beta

Timeline

2026-10-17: disclosed
2026-10-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.