CVE-2026-111888: Incorrect Authorization in thorsten phpMyFAQ

An incorrect authorization vulnerability exists in phpMyFAQ versions >=4.0.0 and <4.1.9. The PUT /admin/api/news/update endpoint improperly validates permissions by checking NEWS_DELETE instead of NEWS_EDIT. As a result, delegated administrators who lack the editnews right but have addnews and delnews rights can modify news items by leveraging their ability to read the update-news CSRF token from their own cookie. This allows them to rewrite news headers, bodies, authors, links, and active flags shown on the public front page.

Attackers with delegated admin privileges that include addnews and delnews but exclude editnews can modify news items on the public front page. This could lead to unauthorized content changes, potentially misleading users or damaging the integrity of the news displayed. The vulnerability does not allow privilege escalation beyond delegated admin roles, and no known exploits are reported in the wild.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict delegated admin permissions carefully to prevent users from having addnews and delnews rights without editnews rights, or disable the vulnerable API endpoint if possible.