phpMyFAQ before version 4.1.9 and the 4.2.0-alpha series prior to 4.2.0-beta suffer from a cross‑site request forgery flaw that allows an attacker to trigger Elasticsearch and OpenSearch administration operations without a CSRF token. The flaw cannot elevate privileges or execute arbitrary code but can instruct the target to create, drop, or import search indexes, thereby disrupting search functionality and potentially depleting server resources. As a result, the affected service may become unavailable or unreliable to legitimate users.

The vulnerable product is phpMyFAQ, distributed by Thorsten. All releases prior to 4.1.9 and the 4.2.0-alpha line before 4.2.0-beta are affected. Users running these versions must verify their installation and plan remediation accordingly.

Based on the description, it is inferred that exploitation involves a remote CSRF attack that targets an authenticated user with CONFIGURATION_EDIT permission. With a CVSS score of 7.1, this issue is considered high severity. The EPSS score is not available, and the vulnerability is not listed as a known exploited vulnerability in the CISA KEV catalog. Successful exploitation does not grant code execution or privilege escalation, but it can lead to service degradation, resource exhaustion, or loss of search index availability.