Can phpMyFAQ Users Bypass Permissions to Edit Restricted Articles?

The short version

• phpMyFAQ contains a broken object-level authorisation flaw rated high severity.
• Users with global edit permissions can modify FAQs they cannot view.
• Affected versions include all releases prior to 4.1.9 and early 4.2.0 builds.

The details

According to the NVD record for CVE-2026-111908, phpMyFAQ versions 4.0.0 through 4.1.8 and 4.2.0-alpha through 4.2.0-beta contain a significant security flaw. The issue resides in the PUT /api/v3.1/faq/update endpoint. This API component fails to verify whether a user has specific access rights to the target FAQ object. Instead, it only checks if the user possesses the global edit_faq permission.

An authenticated user who holds this global permission can supply the ID of a restricted FAQ they are not authorised to view. By doing so, they can modify the content of that restricted article. This action bypasses standard moderation workflows and allows the user to change the publication state of the FAQ. The weakness is classified as CWE-639, broken object-level authorisation, and carries a CVSS score of 8.7, which is rated as high severity.

The context

This vulnerability impacts deployments of phpMyFAQ that have not yet upgraded to version 4.1.9 or the 4.2.0-beta release. The flaw was present in the 4.0.0 series and carried forward into the initial alpha builds of the 4.2.0 branch. Organisations running these older versions expose their knowledge bases to unauthorised content manipulation by any account with basic editing privileges.

Next steps

Administrators should immediately inventory their phpMyFAQ installations to identify affected versions. Teams must compare their current software version against the safe thresholds of 4.1.9 and 4.2.0-beta. If an installation falls within the vulnerable range, it requires attention. Users should monitor API logs for unusual update requests from accounts that do not typically perform administrative tasks.

What defenders should look for

Teams usually detect this type of object-level bypass by reviewing API access logs for anomalies. Look for authenticated users sending PUT requests to update FAQ IDs they do not normally access. Check whether content changes occur outside of standard moderation windows. Monitor for sudden shifts in publication states, such as private articles becoming public unexpectedly. Investigate any edits made by users with only basic edit permissions that affect high-restriction items. Verify that all modifications align with the user’s expected scope of access.

What to do and how to stay safe: phpMyFAQ

• Audit your phpMyFAQ version and upgrade to 4.1.9 or 4.2.0-beta if vulnerable.
• Review API logs for PUT requests to /api/v3.1/faq/update from unexpected users.
• Restrict the global edit_faq permission to only trusted administrative accounts.
• Monitor for unauthorised changes to restricted FAQ content and publication status.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which phpMyFAQ versions are affected by CVE-2026-111908?

Versions 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta are affected.

What is the CVSS score for this vulnerability?

The CVSS score is 8.7, which is rated as high severity.

How does an attacker exploit this flaw?

An attacker uses the PUT endpoint with a global edit permission to modify restricted FAQs by supplying their ID.