Known as a broken object‑level authorization flaw, the REST API endpoint PUT /api/v3.1/faq/update checks only the global edit_faq permission and does not verify whether the authenticated user actually owns or can view the targeted FAQ. This omission makes the flaw a classic example of CWE‑639, an authorization bypass through user‑controlled keys. An attacker who possesses edit_faq rights can submit the ID of a restricted FAQ that is otherwise inaccessible and change its contents, including the publication state, effectively bypassing moderation controls. This results in unauthorized data tampering and could alter public knowledge presented by the FAQ.

This vulnerability affects phpMyFAQ versions 4.0.0 through 4.1.8 and 4.2.0-alpha up to but not including 4.2.0-beta. Vendors are thorsten:phpMyFAQ; no sub‑vendors are listed. Users running these releases without the corresponding fix are susceptible to the described authorization bypass.

The CVSS score of 8.7 indicates a high‑severity risk. EPSS data is not available, so the exact exploitation probability is unknown, but the vulnerability is fully exploitable over the network via authenticated REST calls. The affected systems are not listed in CISA’s KEV catalog, which suggests no widely documented exploitation yet, yet the lack of proper authorization makes the risk significant for any environment exposing the API.