CVE-2026-111908: Authorization Bypass Through User-Controlled Key in thorsten phpMyFAQ

The vulnerability in phpMyFAQ affects the PUT /api/v3.1/faq/update endpoint, which improperly checks only the global edit_faq permission without verifying if the user has access rights to the specific FAQ being modified. This broken object-level authorization allows authenticated users with edit_faq permission to supply the ID of restricted FAQs they cannot view and modify their content and publication status. The affected versions are phpMyFAQ 4.0.0 up to but not including 4.1.9, and 4.2.0-alpha up to but not including 4.2.0-beta. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

An attacker with authenticated edit_faq permission can bypass intended access controls to modify restricted FAQ entries, potentially altering content and publication state without proper authorization. This can lead to unauthorized content changes and bypass of moderation controls, impacting data integrity and confidentiality within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict edit_faq permissions to trusted users only to minimize risk. Monitor for vendor updates regarding patches or official fixes.