# CVE-2026-111905: phpMyFAQ insecure direct object reference in admin user API

Source: https://junglewise.ai/threats/cve-2026-111905-phpmyfaq-3-2-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111905 · Severity: medium · CVSS 6 · Published 2026-10-17

phpMyFAQ is a frequently-asked-questions knowledge base system commonly used in business support portals. The admin REST API endpoint that retrieves user data exposes live TOTP two-factor authentication secrets without proper access controls, allowing delegated administrators to steal a SuperAdmin's 2FA credential and gain full account access, bypassing two-factor authentication entirely.

Technologies: [Phpmyfaq](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq-1). Vendors: [Phpmyfaq](https://junglewise.ai/threats/vendors/phpmyfaq).

## Quick answers

**Is CVE-2026-111905 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111905 being exploited in the wild.

**How severe is CVE-2026-111905?** Medium severity, with a CVSS score of 6, published 17 October 2026.

**Which products and versions are affected?** Phpmyfaq 3.2.0 before 4.1.9; 4.2.0-alpha before 4.2.0-beta.

**Is there a fix for CVE-2026-111905?** Yes: fixed in phpMyFAQ 4.1.9, 4.2.0-beta. Until then: Restrict access to the /admin/api/user/data endpoint to SuperAdmin users only, or disable the endpoint until upgrading if user-management delegation is not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111905 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111905?** Check whether you run Phpmyfaq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in phpMyFAQ 4.1.9, 4.2.0-beta

Restrict access to the /admin/api/user/data endpoint to SuperAdmin users only, or disable the endpoint until upgrading if user-management delegation is not required.

## Technical details

An insecure direct object reference (IDOR) vulnerability in GET /admin/api/user/data/{userId} returns the raw database row for any user, including the secret column containing the live TOTP seed, to any authenticated administrator holding user-management rights, without verifying that the acting user is a SuperAdmin or that the target is protected. An attacker with delegated admin privileges can enumerate arbitrary user IDs to extract a SuperAdmin's TOTP secret, then generate valid time-based one-time passwords to impersonate them. The vulnerability stems from the read endpoint's lack of the SuperAdmin/protected-target guard that the write sibling endpoints (editUser, deleteUser, etc.) all implement.

## Affected products

- phpMyFAQ phpMyFAQ 3.2.0 before 4.1.9; 4.2.0-alpha before 4.2.0-beta

## Timeline

- 2026-10-17: disclosed
- 2026-10-03: advisory

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hp8j-w94m-j5c7](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hp8j-w94m-j5c7)
- [https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-idor-leaks-totp-secret-via-admin-api-user-data](https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-idor-leaks-totp-secret-via-admin-api-user-data)

## Related threats

- [phpMyFAQ uncontrolled resource consumption in API pagination](https://junglewise.ai/threats/cve-2026-111901-phpmyfaq-4-2-0-alpha-before-4-2-0-beta-contains-an-uncontrolled)
- [phpMyFAQ improper authorization in attachment.php](https://junglewise.ai/threats/cve-2026-111900-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ authentication bypass in Microsoft Entra ID login](https://junglewise.ai/threats/cve-2026-111895-phpmyfaq-3-2-0-before-4-0-0-and-4-0-2-before-4-2-0-beta-contains)
- [phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP…](https://junglewise.ai/threats/cve-2026-76208-phpmyfaq-versions-3-1-0-through-4-1-6-contain-an-authentication)
- [phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()](https://junglewise.ai/threats/cve-2026-34729-phpmyfaq-stored-xss-via-regex-bypass-in-filter-removeattributes)