# CVE-2026-111907: phpMyFAQ cross-site request forgery in database update endpoint

Source: https://junglewise.ai/threats/cve-2026-111907-phpmyfaq-4-0-0-before-4-1-9-contains-a-cross-site-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111907 · Severity: high · CVSS 7.1 · Published 2026-10-17

phpMyFAQ is a frequently asked questions management system. A CSRF vulnerability in the database migration endpoint allows attackers to trick logged-in administrators into triggering unauthorized database migrations, potentially causing data corruption or system unavailability. An attacker can craft a malicious webpage that, when visited by an authenticated admin, silently executes dangerous database operations.

Technologies: [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-111907 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111907 being exploited in the wild.

**How severe is CVE-2026-111907?** High severity, with a CVSS score of 7.1, published 17 October 2026.

**Which products and versions are affected?** Thorsten phpMyFAQ 4.0.0 before 4.1.9.

**Is there a fix for CVE-2026-111907?** Yes: fixed in 4.1.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111907 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111907?** Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.1.9

## Technical details

The POST /admin/api/update-database endpoint executes database migrations without validating a CSRF token, relying only on the CONFIGURATION_EDIT permission check. An unauthenticated attacker on the network can forge a cross-site request targeting a logged-in user with appropriate permissions, causing unintended database migrations. The vulnerability requires user interaction (the victim must visit the attacker's page while authenticated) but has high availability impact.

## Affected products

- thorsten phpMyFAQ 4.0.0 before 4.1.9

## Timeline

- 2026-10-03: disclosed
- 2026-10-17: advisory

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6x9g-rfx8-g42q](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6x9g-rfx8-g42q)
- [https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-csrf-via-admin-api-update-database](https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-csrf-via-admin-api-update-database)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)