CVE-2026-111884: Use of Single-factor Authentication in thorsten phpMyFAQ
Description
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.
CVSS v4.0
Score 8.7high
Affected software
thorsten
phpMyFAQ
thorsten
phpMyFAQ
pkg:github/thorsten/phpMyFAQRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in phpMyFAQ affects versions prior to 4.1.9 and versions from 4.2.0-alpha up to but not including 4.2.0-beta. The issue is that the UserController::updateData endpoint (api/user/data/update) does not require the current password when changing the account email, only validating the session and CSRF token. An attacker who has hijacked a valid session can exploit this by changing the victim's email to their own, then triggering the password reset flow to gain control of the account if it lacks two-factor authentication.
Potential Impact
An attacker with access to a hijacked session can take over user accounts, including those with superadmin privileges, if the accounts do not have two-factor authentication enabled. This leads to account takeover and potential full administrative control over the phpMyFAQ installation.
Mitigation Recommendations
Patch to phpMyFAQ version 4.1.9 or later, or to versions after 4.2.0-beta where this issue is fixed. Until patched, enforce two-factor authentication to mitigate risk. Patch status is not explicitly stated in the provided data; verify with vendor advisories for official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-17T12:15:56.789Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad3c6ce2cdf04f6565207ee
Added to database: 10/17/2026, 19:04:46 UTC
Last enriched: 10/17/2026, 19:33:36 UTC
Last updated: 10/17/2026, 22:21:06 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.