phpMyFAQ versions 4.0.0 through 4.1.8 contain a flaw in the news update API: the endpoint /admin/api/news/update checks for the NEWS_DELETE permission instead of the intended NEWS_EDIT permission. This mis‑authorization permits any delegated admin who has the addnews and delnews rights to modify any news entry, changing its header, body, author, link, and active status, all of which are displayed on the public front page. Based on the description, the ability to alter visible news items could be abused for defacement, but the CVE advisory does not specify such an outcome.

Affecting phpMyFAQ versions 4.0.0 up to, but not including, 4.1.9, any installation that utilizes a vulnerable version with delegated admin accounts holding addnews and delnews rights is susceptible. The vulnerability is embedded in the forum software distributed by the vendor thorsten.

The CVSS score of 5.1 indicates moderate severity. EPSS data is unavailable and the issue is not listed in CISA KEV, implying no widespread exploitation to date. The attack requires an authenticated admin session with the specific rights; the vulnerability is therefore a privilege escalation or internal‑only risk rather than an open remote exploit.