PhpMyFAQ (< 4.1.10) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/phpmyfaq--4.1.10/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 14:32:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgphpMyFAQ: Object-level authorization bypass (CVE-2026-116183)https://feed.craftedsignal.io/briefs/2026-10-phpmyfaq-auth-bypass/Sun, 25 Oct 2026 14:32:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-phpmyfaq-auth-bypass/An object-level authorization bypass in phpMyFAQ versions prior to 4.1.10 allows unauthenticated attackers to modify or delete visitor questions via the API.phpMyFAQ versions prior to 4.1.10 contain an object-level authorization bypass vulnerability (CVE-2026-116183). The vulnerability resides in the POST /api/faq/create endpoint, where insufficient validation of the openQuestionID parameter allows unauthenticated actors to modify or delete visitor questions. Successful exploitation requires solving the CAPTCHA and allows attackers to rewrite categories, forge entries in faqquestion_history, or delete questions if the records.enableDeleteQuestion configuration is active.

Impact

Unauthorized modification or deletion of visitor questions, manipulation of question categories, and potential corruption of question history records.

Recommendation

  • Upgrade phpMyFAQ to version 4.1.10 or later immediately.
  • If patching is delayed, audit web server logs for suspicious POST requests to /api/faq/create containing openQuestionID parameters.
  • Disable records.enableDeleteQuestion in the application configuration to prevent unauthorized question deletion until the patch is applied.
]]>highadvisory