{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/phpmyfaq--4.1.10/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-116183"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["phpMyFAQ (\u003c 4.1.10)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["phpMyFAQ"],"content_html":"\u003cp\u003ephpMyFAQ versions prior to 4.1.10 contain an object-level authorization bypass vulnerability (CVE-2026-116183). The vulnerability resides in the \u003ccode\u003ePOST /api/faq/create\u003c/code\u003e endpoint, where insufficient validation of the \u003ccode\u003eopenQuestionID\u003c/code\u003e parameter allows unauthenticated actors to modify or delete visitor questions. Successful exploitation requires solving the CAPTCHA and allows attackers to rewrite categories, forge entries in \u003ccode\u003efaqquestion_history\u003c/code\u003e, or delete questions if the \u003ccode\u003erecords.enableDeleteQuestion\u003c/code\u003e configuration is active.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUnauthorized modification or deletion of visitor questions, manipulation of question categories, and potential corruption of question history records.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade phpMyFAQ to version 4.1.10 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf patching is delayed, audit web server logs for suspicious POST requests to \u003ccode\u003e/api/faq/create\u003c/code\u003e containing \u003ccode\u003eopenQuestionID\u003c/code\u003e parameters.\u003c/li\u003e\n\u003cli\u003eDisable \u003ccode\u003erecords.enableDeleteQuestion\u003c/code\u003e in the application configuration to prevent unauthorized question deletion until the patch is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T14:32:35Z","date_published":"2026-10-25T14:32:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-phpmyfaq-auth-bypass/","summary":"An object-level authorization bypass in phpMyFAQ versions prior to 4.1.10 allows unauthenticated attackers to modify or delete visitor questions via the API.","title":"phpMyFAQ: Object-level authorization bypass (CVE-2026-116183)","url":"https://feed.craftedsignal.io/briefs/2026-10-phpmyfaq-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - PhpMyFAQ (\u003c 4.1.10)","version":"https://jsonfeed.org/version/1.1"}