Because the API write endpoints in phpMyFAQ prior to version 4.1.4 use only a shared token rather than individual role checks, an attacker who obtains a valid token can create, update, or delete categories, FAQs, and questions. This flaw allows arbitrary alteration of the FAQ content, directly compromising the integrity of the data stored by the application. The weakness is a classic missing authorization issue (CWE‑862).

The affected product is phpMyFAQ from the vendor thorsten. All releases older than 4.1.4 are vulnerable. This includes the 4.0.x series and any pre‑4.1.4 build that has the public API enabled.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by sending crafted HTTP requests to the POST /api/v4.0/category, POST /api/v4.0/faq, PUT /api/v4.0/faq, or POST /api/v4.0/question endpoints, provided they hold a functional shared API key. The attack requires only network access to the target application and does not rely on privileged user credentials. Given the moderate CVSS score, the risk is significant enough to warrant prompt remediation.