CVE-2026-111905: phpMyFAQ Authentication Bypass Vulnerability

CVE-2026-111905 Overview

CVE-2026-111905 is an insecure direct object reference (IDOR) vulnerability in phpMyFAQ affecting versions 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta. The flaw resides in the GET /admin/api/user/data/{userId} endpoint, which returns any user's full faquserdata row without enforcing a SuperAdmin or protected-target access check. The exposed data includes the live Time-based One-Time Password (TOTP) secret used for two-factor authentication. A delegated administrator with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes, defeating 2FA on privileged accounts.

Critical Impact

Authenticated administrators can harvest TOTP secrets of SuperAdmin accounts and bypass two-factor authentication, enabling full administrative takeover of phpMyFAQ instances.

Affected Products

• phpMyFAQ 3.2.0 through versions prior to 4.1.9
• phpMyFAQ 4.2.0-alpha through versions prior to 4.2.0-beta
• Deployments relying on TOTP-based two-factor authentication for administrative accounts

Discovery Timeline

• 2026-10-17 - CVE-2026-111905 published to the National Vulnerability Database
• 2026-10-21 - Record last modified in NVD

Technical Details for CVE-2026-111905

Vulnerability Analysis

The vulnerability is classified under [CWE-639] Authorization Bypass Through User-Controlled Key. The GET /admin/api/user/data/{userId} endpoint accepts a user identifier as a path parameter and returns the matching faquserdata row in full. The handler verifies that the caller holds general user-management privileges but omits a secondary check confirming that the target user is not a SuperAdmin or otherwise protected. As a result, a delegated administrator can request any user record, including those belonging to higher-privileged accounts.

The returned payload includes the live TOTP shared secret stored for the target account. Because TOTP codes are deterministic given the shared secret and the current timestamp, possession of the secret allows an attacker to generate valid six-digit codes at will. Combined with a known or reset password, this reduces multi-factor authentication to a single-factor control.

Root Cause

The root cause is missing object-level authorization on the user data API. The endpoint trusts the caller's role for the action but does not evaluate the sensitivity of the requested object. Sensitive authentication material such as the TOTP seed is also returned by the same API used for routine user administration, violating the principle of least privilege for data exposure.

Attack Vector

Exploitation requires an authenticated session with user-management rights on the phpMyFAQ admin interface. The attacker issues a single HTTP GET request against /admin/api/user/data/{userId}, substituting the numeric identifier of a SuperAdmin account. The response discloses the stored TOTP secret, which the attacker loads into any standard authenticator application or script to produce valid 2FA codes. If the attacker also knows or can reset the SuperAdmin password, full account takeover follows. Refer to the GitHub Security Advisory GHSA-hp8j-w94m-j5c7 and the VulnCheck Advisory for phpMyFAQ for technical details.

Detection Methods for CVE-2026-111905

Indicators of Compromise

• Unexpected GET /admin/api/user/data/{userId} requests where {userId} targets SuperAdmin accounts
• Access to the user data endpoint from administrator accounts that do not normally perform user management tasks
• Successful SuperAdmin logins from new IP addresses or user agents shortly after reads of the user data API
• Modifications to SuperAdmin profiles, roles, or FAQ content following anomalous admin API activity

Detection Strategies

• Enable verbose access logging on the phpMyFAQ admin API and alert on requests to /admin/api/user/data/ that reference user IDs outside the caller's management scope
• Correlate reads of the user data endpoint with subsequent authentication events for the targeted account within a short time window
• Baseline normal administrator behavior and flag horizontal access patterns across multiple user records in a single session

Monitoring Recommendations

• Forward web server and application logs to a centralized analytics platform for retention and rule-based alerting
• Monitor for repeated enumeration of sequential or elevated user IDs against the admin API
• Track and alert on changes to TOTP enrollment, password resets, and role assignments on SuperAdmin accounts

How to Mitigate CVE-2026-111905

Immediate Actions Required

• Upgrade phpMyFAQ to version 4.1.9 or 4.2.0-beta or later as soon as possible
• Rotate TOTP secrets for all administrator accounts, requiring re-enrollment of authenticator applications
• Reset passwords for SuperAdmin and other privileged accounts after upgrading
• Audit admin API access logs for prior exploitation of /admin/api/user/data/{userId}

Patch Information

The maintainers address the IDOR by enforcing a SuperAdmin and protected-target check on the GET /admin/api/user/data/{userId} endpoint. Fixed releases are phpMyFAQ 4.1.9 for the 4.1 branch and 4.2.0-beta for the 4.2 pre-release branch. See the GitHub Security Advisory GHSA-hp8j-w94m-j5c7 for upstream patch references.

Workarounds

• Restrict user-management privileges to a minimal set of trusted administrators until upgrade is complete
• Place the /admin/ path behind an additional authentication layer such as HTTP basic auth or an authenticating reverse proxy
• Temporarily block the /admin/api/user/data/ route at the web server or WAF level if administrative workflows allow
• Enforce IP allow-listing for administrative access to reduce the exploitable attack surface

# Example nginx snippet to block the vulnerable endpoint pending upgrade
location ~ ^/admin/api/user/data/ {
    deny all;
    return 403;
}