phpMyFAQ: Object-level authorization bypass (CVE-2026-116183)
An object-level authorization bypass in phpMyFAQ versions prior to 4.1.10 allows unauthenticated attackers to modify or delete visitor questions via the API.
CVE search metadata
CVE search record: CVE-2026-116183. Severity: high. CVSS: 7.5. KEV: no. Product: phpMyFAQ (< 4.1.10). Brief: phpMyFAQ: Object-level authorization bypass (CVE-2026-116183). Brief link: https://feed.craftedsignal.io/briefs/2026-10-phpmyfaq-auth-bypass/
Triage facts
Revision 1- Applicability
- phpMyFAQ (< 4.1.10)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 25, 14:32 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
phpMyFAQ versions prior to 4.1.10 contain an object-level authorization bypass vulnerability (CVE-2026-116183). The vulnerability resides in the POST /api/faq/create endpoint, where insufficient validation of the openQuestionID parameter allows unauthenticated actors to modify or delete visitor questions. Successful exploitation requires solving the CAPTCHA and allows attackers to rewrite categories, forge entries in faqquestion_history, or delete questions if the records.enableDeleteQuestion configuration is active.
Impact
Unauthorized modification or deletion of visitor questions, manipulation of question categories, and potential corruption of question history records.
Recommendation
- Upgrade phpMyFAQ to version 4.1.10 or later immediately.
- If patching is delayed, audit web server logs for suspicious POST requests to
/api/faq/createcontainingopenQuestionIDparameters. - Disable
records.enableDeleteQuestionin the application configuration to prevent unauthorized question deletion until the patch is applied.
Immediate actions
Upgrade phpMyFAQ to 4.1.10 or later
Threat Hunt
Monitor web server logs for POST requests to /api/faq/create containing arbitrary openQuestionID values
Data: Web server access logs
Mitigations
Disable records.enableDeleteQuestion in the configuration
CVE-2026-116183