CVE-2026-111907: Cross-Site Request Forgery (CSRF) in thorsten phpMyFAQ

The vulnerability in phpMyFAQ 4.0.0 before 4.1.9 is a CSRF flaw affecting the POST /admin/api/update-database endpoint. Because this endpoint lacks CSRF token validation, an attacker can induce a logged-in user with the appropriate permissions to unknowingly trigger database migrations. These migrations could alter the database state, potentially affecting its integrity or availability. The CVSS 4.0 score is 7.1 (high severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on availability.

An attacker can cause a logged-in user with CONFIGURATION_EDIT permission to execute unauthorized database migrations. This can lead to disruption of database integrity or availability, potentially affecting the application's stability or data consistency.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with CONFIGURATION_EDIT permissions and avoid visiting untrusted sites while logged in to phpMyFAQ. Implementing CSRF protections or disabling the vulnerable endpoint may mitigate risk.