# CVE-2026-111908: phpMyFAQ broken object-level authorization in FAQ update API

Source: https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111908 · Severity: high · CVSS 8.3 · Published 2026-10-17

phpMyFAQ is a widely-used FAQ management system for creating and maintaining frequently-asked-question databases. An authentication bypass flaw in its REST API allows editors with basic FAQ editing permissions to modify restricted FAQs they should not have access to, including bypassing moderation workflows and forcibly publishing restricted content. This impacts organizations relying on phpMyFAQ to enforce content access controls and publication workflows.

Technologies: [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-111908 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111908 being exploited in the wild.

**How severe is CVE-2026-111908?** High severity, with a CVSS score of 8.3, published 17 October 2026.

**Which products and versions are affected?** Thorsten phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.

**Is there a fix for CVE-2026-111908?** Yes: fixed in 4.1.9, 4.2.0-beta. Until then: Restrict API access to the PUT /api/v3.1/faq/update endpoint to trusted administrators only, or temporarily disable the endpoint until patching is completed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111908 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111908?** Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.1.9, 4.2.0-beta

Restrict API access to the PUT /api/v3.1/faq/update endpoint to trusted administrators only, or temporarily disable the endpoint until patching is completed.

## Technical details

The PUT /api/v3.1/faq/update endpoint performs only a global permission check (edit_faq) and fails to enforce object-level authorization on the target FAQ ID. An authenticated user with edit_faq permission can supply the ID of any FAQ—including restricted ones they cannot read—and modify its content, metadata, and publication state. The vulnerability affects versions 4.0.0–4.1.8 and 4.2.0-alpha, and requires network access and valid authentication credentials.

## Affected products

- thorsten phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta

## Timeline

- 2026-10-03: disclosed
- 2026-10-17: advisory

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3px-r7cr-r26r](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3px-r7cr-r26r)
- [https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-bola-in-faq-update-via-rest-api](https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-bola-in-faq-update-via-rest-api)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ cross-site request forgery in database update endpoint](https://junglewise.ai/threats/cve-2026-111907-phpmyfaq-4-0-0-before-4-1-9-contains-a-cross-site-request)