Description
phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.
Published: 2026-10-17
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data exposure via missing admin authorization
Action: Apply Patch
AI Analysis

Impact

phpMyFAQ versions 4.1.0 through 4.1.8 and 4.2.0‑alpha before 4.2.0‑beta contain a missing authorization defect in the admin dashboard. Authenticated users who are not administrators can request the /admin/index.php/ page and read unpublished forum questions, edit URLs, user identities, and site statistics. This flaw confidentiality breach by allowing non‑admin accounts to view restricted information, which is marked as CWE‑862.

Affected Systems

The affected product is phpMyFAQ from its vendor thorsten. Versions 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.1.8 and 4.2.0‑alpha up to but not including 4.2.0‑beta are impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog, so publicly reported exploitation is not known. However, any user with an active account can exploit the flaw, making it a widespread risk for installations that allow non‑admin users to register or be added. Impact is limited to confidentiality, and successful exploitation does not alter application logic or availability.

Generated by OpenCVE AI on October 17, 2026 at 20:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade phpMyFAQ to version 4.1.9 or later 4.2.0‑beta to obtain the authorization fix
  • Confirm that only users with administrator rights can access the /admin directory and related endpoints
  • Audit the application for other missing authorization checks and apply patches or code changes as needed
  • Configure logging to detect unexpected access to admin URLs by non‑admin accounts

Generated by OpenCVE AI on October 17, 2026 at 20:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 17 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.
Title phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard
First Time appeared Phpmyfaq
Phpmyfaq phpmyfaq
Weaknesses CWE-862
CPEs cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*
Vendors & Products Phpmyfaq
Phpmyfaq phpmyfaq
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Phpmyfaq Phpmyfaq
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-18T13:26:41.571Z

Reserved: 2026-10-17T12:15:56.790Z

Link: CVE-2026-111889

cve-icon Vulnrichment

Updated: 2026-10-18T13:26:38.211Z

cve-icon NVD

Status : Deferred

Published: 2026-10-17T19:16:30.237

Modified: 2026-10-18T14:16:54.513

Link: CVE-2026-111889

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T21:00:14Z

Weaknesses