The vulnerability is a cross‑site request forgery in the POST /admin/api/update-database endpoint of phpMyFAQ. The endpoint runs database migrations when a request is received without verifying a CSRF token. An attacker can trick a logged‑in user who has the CONFIGURATION_EDIT permission into submitting a forged request, causing unintended schema changes or data alterations that compromise database integrity or disrupt service availability.

The affected product is phpMyFAQ provided by Thorsten. Versions 4.0.0 through 4.1.8 are vulnerable. Versions 4.1.9 and later include the fix that validates a CSRF token before running migrations.

With a CVSS score of 7.1 the vulnerability is moderate in severity. The EPSS score is not provided, and the flaw is not listed in the CISA KEV catalog, indicating no known active exploitation at this time. The likely attack vector is a crafted cross‑site request from a malicious website or malicious script that triggers the POST request while the victim is. Exploitation requires an authenticated user with configuration‑edit rights, so the risk is limited to users who have that permission, but once triggered the attacker can alter or disrupt the database. Overall the risk is moderate and should be mitigated promptly.