Executive brief
phpMyFAQ is an open-source FAQ software. A security flaw in its programming interface (API) allows any user with a valid API key to perform administrative actions, such as creating or editing FAQ entries and categories, even if their account does not have permission to do so. This could lead to unauthorized content modification or data manipulation by low-privileged users.
Technical details
A missing authorization vulnerability exists in phpMyFAQ's API controllers. While the application validates the API token via hasValidToken(), it fails to call userHasPermission() for specific write operations in CategoryController, FaqController, and QuestionController. This is an incomplete fix for a previous issue (CVE-2026-24421). An attacker with a valid API token can bypass role-based access control (RBAC) to create categories, create/update FAQ entries, and create questions. The vulnerability is addressed in version 4.1.4 by implementing the missing userHasPermission() checks using existing PermissionType enums.
Affected products
- thorsten phpMyFAQ < 4.1.4
Timeline
- 2026-05-25: disclosed: Initial disclosure and patch commit
- 2026-06-18: advisory: NVD publication
- 2026-06-23: advisory: GitHub Advisory reviewed and published
References
- https://api.github.com/users/santhoshinipayload
- https://github.com/santhoshinipayload
- https://api.github.com/users/santhoshinipayload/gists%7B/gist_id%7D
- https://api.github.com/users/santhoshinipayload/repos
- https://avatars.githubusercontent.com/u/126679346?v=4
- https://api.github.com/users/santhoshinipayload/events%7B/privacy%7D