CVE-2026-111906: Cross-Site Request Forgery (CSRF) in thorsten phpMyFAQ

CVE-2026-111906 is a CSRF vulnerability affecting phpMyFAQ in versions prior to 4.1.9 and between 4.2.0-alpha and before 4.2.0-beta. The flaw exists in the Elasticsearch and OpenSearch administration API endpoints, which lack validation of CSRF tokens for critical actions such as create, drop, and import. This allows an attacker to induce a privileged user to perform unwanted administrative actions by visiting a crafted malicious webpage, leading to deletion of search indexes, forced re-indexing, or resource exhaustion.

Successful exploitation allows an attacker to perform unauthorized administrative actions on the Elasticsearch and OpenSearch indexes via the phpMyFAQ API. This can result in deletion of search indexes, forced re-indexing processes, or resource exhaustion, potentially disrupting search functionality and degrading system performance. The attack requires a user with CONFIGURATION_EDIT permissions to be tricked into visiting a malicious page.

Users should upgrade phpMyFAQ to versions 4.1.9 or later, or to versions 4.2.0-beta or later, where this CSRF vulnerability has been addressed. Patch status is implied by the affected version ranges; versions outside these ranges are not vulnerable. No additional vendor advisory is provided, so verify with official phpMyFAQ sources for the latest remediation guidance.