CVE-2026-111908: phpMyFAQ Authorization Bypass Vulnerability

CVE-2026-111908 Overview

CVE-2026-111908 is a broken object-level authorization (BOLA) vulnerability in phpMyFAQ, affecting versions 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta. The flaw resides in the PUT /api/v3.1/faq/update REST endpoint. The endpoint validates only the global edit_faq permission and fails to confirm whether the authenticated user has access to the specific FAQ identified in the request. Attackers with low-privilege accounts can modify restricted FAQs, bypass moderation workflows, and alter publication state. The issue is categorized under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Authenticated users holding the edit_faq permission can tamper with FAQs they are not authorized to view, undermining content integrity and moderation controls.

Affected Products

• phpMyFAQ 4.0.0 through versions prior to 4.1.9
• phpMyFAQ 4.2.0-alpha through versions prior to 4.2.0-beta
• Deployments exposing the /api/v3.1/faq/update REST endpoint to authenticated users

Discovery Timeline

• 2026-10-17 - CVE-2026-111908 published to the National Vulnerability Database
• 2026-10-19 - Last updated in the NVD database

Technical Details for CVE-2026-111908

Vulnerability Analysis

phpMyFAQ exposes a REST API for managing FAQ content. The PUT /api/v3.1/faq/update route accepts an FAQ identifier in the request body and updates the referenced record. The handler enforces authorization by checking the caller's global edit_faq role grant. It does not evaluate whether the authenticated principal has visibility or edit scope over the target FAQ. Any user granted edit_faq, including contributors restricted to specific categories, can submit the identifier of a restricted FAQ and overwrite its content, metadata, and active publication flag. This behavior defeats category-level access boundaries and moderation gates designed to review changes before publication.

Root Cause

The root cause is a missing object-level authorization check. The handler conflates feature-level permissions with per-object permissions. phpMyFAQ's data model supports restricted FAQs that should be invisible or non-editable to users outside a given group, but the API endpoint omits the ownership and group-membership checks that the web UI applies. This is a classic BOLA pattern listed as API1:2023 in the OWASP API Security Top 10.

Attack Vector

Exploitation requires network access to the application and a valid authenticated session with the edit_faq permission. The attacker enumerates or guesses the numeric id of a restricted FAQ and issues a PUT request to /api/v3.1/faq/update with modified fields. The server accepts the write, replaces the stored content, and can mark the record as published, bypassing moderator approval. No user interaction and no elevated privileges are required beyond the baseline edit_faq grant. See the GitHub Security Advisory GHSA-j3px-r7cr-r26r for upstream technical details.

Detection Methods for CVE-2026-111908

Indicators of Compromise

• Unexpected PUT requests to /api/v3.1/faq/update originating from accounts that do not own the target FAQ category
• Audit log entries showing content, title, or active state changes to restricted FAQs made by non-owning users
• Publication-state transitions on FAQs that bypassed the normal moderation queue

Detection Strategies

• Correlate API access logs with the FAQ ownership and group-permission tables to flag writes crossing authorization boundaries
• Alert on PUT /api/v3.1/faq/update activity from low-privilege accounts targeting FAQ identifiers outside their assigned categories
• Baseline normal editor behavior and surface accounts that abruptly expand the range of FAQ IDs they modify

Monitoring Recommendations

• Enable verbose request logging on the phpMyFAQ REST API, capturing authenticated user, target FAQ ID, and response code
• Forward web server and application logs to a centralized analytics platform to retain evidence for post-incident review
• Review the FAQ change history on a scheduled cadence until the patched release is deployed

How to Mitigate CVE-2026-111908

Immediate Actions Required

• Upgrade phpMyFAQ to version 4.1.9 or 4.2.0-beta or later as identified in the vendor advisory
• Audit all accounts holding the edit_faq permission and revoke the grant where it is not strictly required
• Review recent modifications to restricted FAQs and roll back any unauthorized changes

Patch Information

The maintainer addressed the issue in phpMyFAQ 4.1.9 and 4.2.0-beta. The fix adds object-level authorization in the update endpoint so that the server verifies the caller's access to the target FAQ before persisting changes. Patch details and release notes are available in the GitHub Security Advisory and the VulnCheck advisory.

Workarounds

• Restrict access to the /api/v3.1/faq/ routes at the reverse proxy or web application firewall layer until upgrade is possible
• Temporarily revoke the edit_faq permission from all non-administrator roles to limit the pool of accounts that can trigger the flaw
• Disable public API registration and require administrator approval for new accounts to prevent attacker-controlled low-privilege sessions

# Example nginx restriction limiting the vulnerable endpoint to trusted IPs
# Replace trusted ranges with values appropriate for your environment
location /api/v3.1/faq/update {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://phpmyfaq_backend;
}