CVE-2026-116183 phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116183?
CVE-2026-116183 is a high-severity vulnerability in thorsten phpMyFAQ, published on 25 Oct 2026.
Official description
phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.
Weakness: CWE-639
Which versions are affected by CVE-2026-116183?
How do I fix CVE-2026-116183?
No fix has been published for CVE-2026-116183 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116183 being exploited?
There is no known exploitation of CVE-2026-116183 in the wild and no public exploit code.
Sources
Also known as GHSA-9m55-g84r-x6v7, GHSA-hpmh-2f7x-mv5g.