CVE-2026-111888 phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API
Delegated admins can modify public news items by exploiting incorrect authorization checks in the news update API.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111888?
CVE-2026-111888 is a medium-severity missing authorization vulnerability in thorsten phpMyFAQ, published on 17 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.
Weakness: CWE-863
Which versions are affected by CVE-2026-111888?
How do I fix CVE-2026-111888?
No fix has been published for CVE-2026-111888 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111888 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111888 exists.
Sources
Also known as GHSA-287v-6c6j-x9f7, GHSA-j2g3-mcv7-r3f2.