CVE-2026-111889: Missing Authorization in thorsten phpMyFAQ

CVE-2026-111889 is a missing authorization vulnerability affecting phpMyFAQ in versions >=4.1.0 <4.1.9 and >=4.2.0-alpha <4.2.0-beta. The vulnerability resides in the admin dashboard, where authenticated users lacking admin rights can access sensitive data that should be restricted. Specifically, attackers with any activated account can request the /admin/index.php/ page to read unpublished FAQ content, administrative edit URLs, recent user identities, and site statistics, bypassing intended access controls.

The vulnerability allows unauthorized disclosure of sensitive administrative data to any authenticated user without admin privileges. This exposure includes unpublished FAQ questions, administrative URLs, user identity information, and site statistics. While it does not allow privilege escalation or remote code execution, the information disclosure could aid attackers in further reconnaissance or targeted attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the admin dashboard to trusted users only and monitor for unauthorized access attempts. Avoid granting unnecessary accounts access to the system.