{"schema_version":"2","view":"grouped","data":[{"id":50464,"cve_ids":["CVE-2026-111905"],"payload":{"kind":"advisory","title":"phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data","summary":"phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.","evidence":"cve:CVE-2026-111905","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111905","aliases":["CVE-2026-111905"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"3.2.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T21:40:10.782Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hp8j-w94m-j5c7","https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-idor-leaks-totp-secret-via-admin-api-user-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111905","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T21:39:44.355200Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hp8j-w94m-j5c7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T21:40:10.782Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:24.781Z"}}},"related_cves":[{"value":"CVE-2026-111905","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dfec0d56-12fb-4a9f-88c7-6efd484d1d5a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111905","advisory_id":"dfec0d56-12fb-4a9f-88c7-6efd484d1d5a","event_types":["advisory"],"published_at":"2026-10-25T13:59:14.26694+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:24.781+00:00","detail_url":"/advisories/advisory%3Adfec0d56-12fb-4a9f-88c7-6efd484d1d5a","group":{"id":"advisory:dfec0d56-12fb-4a9f-88c7-6efd484d1d5a","revision":1,"primary_event_id":49992,"change":"published","superseded_by":[],"changed":{"id":49992,"cve_ids":["CVE-2026-111905"],"payload":{"kind":"advisory","title":"phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data","summary":"phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.","evidence":"cve:CVE-2026-111905","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111905","aliases":["CVE-2026-111905"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"3.2.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T21:40:10.782Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hp8j-w94m-j5c7","https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-idor-leaks-totp-secret-via-admin-api-user-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111905","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T21:39:44.355200Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hp8j-w94m-j5c7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T21:40:10.782Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:24.781Z"}}},"related_cves":[{"value":"CVE-2026-111905","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dfec0d56-12fb-4a9f-88c7-6efd484d1d5a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111905","advisory_id":"dfec0d56-12fb-4a9f-88c7-6efd484d1d5a","event_types":["advisory"],"published_at":"2026-10-25T13:59:14.26694+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:24.781+00:00","detail_url":"/events/49992"},"members":[{"id":49992,"cve_ids":["CVE-2026-111905"],"payload":{"kind":"advisory","title":"phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data","summary":"phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.","evidence":"cve:CVE-2026-111905","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111905","aliases":["CVE-2026-111905"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"3.2.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T21:40:10.782Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hp8j-w94m-j5c7","https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-idor-leaks-totp-secret-via-admin-api-user-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111905","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T21:39:44.355200Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hp8j-w94m-j5c7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T21:40:10.782Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:24.781Z"}}},"related_cves":[{"value":"CVE-2026-111905","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dfec0d56-12fb-4a9f-88c7-6efd484d1d5a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111905","advisory_id":"dfec0d56-12fb-4a9f-88c7-6efd484d1d5a","event_types":["advisory"],"published_at":"2026-10-25T13:59:14.26694+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:24.781+00:00","detail_url":"/events/49992"}]}},{"id":50463,"cve_ids":["CVE-2026-111910"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.","evidence":"cve:CVE-2026-111910","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111910","aliases":["CVE-2026-111910"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T21:41:44.258Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pp67-9fv9-ph7q","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-authorization-bypass-via-attachment-php-downloads"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111910","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T21:41:22.817650Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pp67-9fv9-ph7q","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T21:41:44.258Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:28.155Z"}}},"related_cves":[{"value":"CVE-2026-111910","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:57f53a6d-5a8b-4af2-a9de-a318956aafa0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111910","advisory_id":"57f53a6d-5a8b-4af2-a9de-a318956aafa0","event_types":["advisory"],"published_at":"2026-10-25T13:59:13.601674+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:28.155+00:00","detail_url":"/advisories/advisory%3A57f53a6d-5a8b-4af2-a9de-a318956aafa0","group":{"id":"advisory:57f53a6d-5a8b-4af2-a9de-a318956aafa0","revision":1,"primary_event_id":49991,"change":"published","superseded_by":[],"changed":{"id":49991,"cve_ids":["CVE-2026-111910"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.","evidence":"cve:CVE-2026-111910","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111910","aliases":["CVE-2026-111910"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T21:41:44.258Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pp67-9fv9-ph7q","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-authorization-bypass-via-attachment-php-downloads"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111910","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T21:41:22.817650Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pp67-9fv9-ph7q","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T21:41:44.258Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:28.155Z"}}},"related_cves":[{"value":"CVE-2026-111910","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:57f53a6d-5a8b-4af2-a9de-a318956aafa0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111910","advisory_id":"57f53a6d-5a8b-4af2-a9de-a318956aafa0","event_types":["advisory"],"published_at":"2026-10-25T13:59:13.601674+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:28.155+00:00","detail_url":"/events/49991"},"members":[{"id":49991,"cve_ids":["CVE-2026-111910"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.","evidence":"cve:CVE-2026-111910","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111910","aliases":["CVE-2026-111910"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T21:41:44.258Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pp67-9fv9-ph7q","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-authorization-bypass-via-attachment-php-downloads"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111910","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T21:41:22.817650Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pp67-9fv9-ph7q","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T21:41:44.258Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:28.155Z"}}},"related_cves":[{"value":"CVE-2026-111910","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:57f53a6d-5a8b-4af2-a9de-a318956aafa0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111910","advisory_id":"57f53a6d-5a8b-4af2-a9de-a318956aafa0","event_types":["advisory"],"published_at":"2026-10-25T13:59:13.601674+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:28.155+00:00","detail_url":"/events/49991"}]}},{"id":50461,"cve_ids":["CVE-2026-111900"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id= to download complete attachment files belonging to draft FAQs.","evidence":"cve:CVE-2026-111900","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111900","aliases":["CVE-2026-111900"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T21:39:13.659Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h76j-35m7-3mwq","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-draft-faq-attachment-disclosure-via-attachment-php"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111900","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T21:38:47.188705Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h76j-35m7-3mwq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T21:39:13.659Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:21.382Z"}}},"related_cves":[{"value":"CVE-2026-111900","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a091497d-7eaa-4042-8c48-a8e533d0a500","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111900","advisory_id":"a091497d-7eaa-4042-8c48-a8e533d0a500","event_types":["advisory"],"published_at":"2026-10-25T13:59:12.356898+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:21.382+00:00","detail_url":"/advisories/advisory%3Aa091497d-7eaa-4042-8c48-a8e533d0a500","group":{"id":"advisory:a091497d-7eaa-4042-8c48-a8e533d0a500","revision":1,"primary_event_id":49989,"change":"published","superseded_by":[],"changed":{"id":49989,"cve_ids":["CVE-2026-111900"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id= to download complete attachment files belonging to draft FAQs.","evidence":"cve:CVE-2026-111900","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111900","aliases":["CVE-2026-111900"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T21:39:13.659Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h76j-35m7-3mwq","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-draft-faq-attachment-disclosure-via-attachment-php"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111900","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T21:38:47.188705Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h76j-35m7-3mwq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T21:39:13.659Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:21.382Z"}}},"related_cves":[{"value":"CVE-2026-111900","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a091497d-7eaa-4042-8c48-a8e533d0a500","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111900","advisory_id":"a091497d-7eaa-4042-8c48-a8e533d0a500","event_types":["advisory"],"published_at":"2026-10-25T13:59:12.356898+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:21.382+00:00","detail_url":"/events/49989"},"members":[{"id":49989,"cve_ids":["CVE-2026-111900"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id= to download complete attachment files belonging to draft FAQs.","evidence":"cve:CVE-2026-111900","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111900","aliases":["CVE-2026-111900"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T21:39:13.659Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h76j-35m7-3mwq","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-draft-faq-attachment-disclosure-via-attachment-php"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111900","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T21:38:47.188705Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h76j-35m7-3mwq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T21:39:13.659Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:21.382Z"}}},"related_cves":[{"value":"CVE-2026-111900","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a091497d-7eaa-4042-8c48-a8e533d0a500","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111900","advisory_id":"a091497d-7eaa-4042-8c48-a8e533d0a500","event_types":["advisory"],"published_at":"2026-10-25T13:59:12.356898+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:21.382+00:00","detail_url":"/events/49989"}]}},{"id":50457,"cve_ids":["CVE-2026-111894"],"payload":{"kind":"advisory","title":"phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI","summary":"phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.","evidence":"cve:CVE-2026-111894","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111894","aliases":["CVE-2026-111894"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"3.2.1","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T21:36:08.684Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fg92-v5rr-4xjq","https://www.vulncheck.com/advisories/phpmyfaq-3.2.1-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-iframe-data-uri"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111894","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T21:35:46.990499Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fg92-v5rr-4xjq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T21:36:08.684Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:17.887Z"}}},"related_cves":[{"value":"CVE-2026-111894","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:29128450-4ca1-4a59-8ea5-a539c0bdcd5b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111894","advisory_id":"29128450-4ca1-4a59-8ea5-a539c0bdcd5b","event_types":["advisory"],"published_at":"2026-10-25T13:59:09.805853+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:17.887+00:00","detail_url":"/advisories/advisory%3A29128450-4ca1-4a59-8ea5-a539c0bdcd5b","group":{"id":"advisory:29128450-4ca1-4a59-8ea5-a539c0bdcd5b","revision":1,"primary_event_id":49985,"change":"published","superseded_by":[],"changed":{"id":49985,"cve_ids":["CVE-2026-111894"],"payload":{"kind":"advisory","title":"phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI","summary":"phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.","evidence":"cve:CVE-2026-111894","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111894","aliases":["CVE-2026-111894"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"3.2.1","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T21:36:08.684Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fg92-v5rr-4xjq","https://www.vulncheck.com/advisories/phpmyfaq-3.2.1-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-iframe-data-uri"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111894","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T21:35:46.990499Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fg92-v5rr-4xjq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T21:36:08.684Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:17.887Z"}}},"related_cves":[{"value":"CVE-2026-111894","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:29128450-4ca1-4a59-8ea5-a539c0bdcd5b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111894","advisory_id":"29128450-4ca1-4a59-8ea5-a539c0bdcd5b","event_types":["advisory"],"published_at":"2026-10-25T13:59:09.805853+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:17.887+00:00","detail_url":"/events/49985"},"members":[{"id":49985,"cve_ids":["CVE-2026-111894"],"payload":{"kind":"advisory","title":"phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI","summary":"phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.","evidence":"cve:CVE-2026-111894","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111894","aliases":["CVE-2026-111894"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"3.2.1","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T21:36:08.684Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fg92-v5rr-4xjq","https://www.vulncheck.com/advisories/phpmyfaq-3.2.1-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-iframe-data-uri"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111894","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T21:35:46.990499Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fg92-v5rr-4xjq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T21:36:08.684Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:17.887Z"}}},"related_cves":[{"value":"CVE-2026-111894","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:29128450-4ca1-4a59-8ea5-a539c0bdcd5b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111894","advisory_id":"29128450-4ca1-4a59-8ea5-a539c0bdcd5b","event_types":["advisory"],"published_at":"2026-10-25T13:59:09.805853+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:17.887+00:00","detail_url":"/events/49985"}]}},{"id":42271,"cve_ids":["CVE-2026-111908"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API","summary":"phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.","evidence":"cve:CVE-2026-111908","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111908","aliases":["CVE-2026-111908"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T21:33:12.329Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3px-r7cr-r26r","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-bola-in-faq-update-via-rest-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111908","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-19T21:32:52.162809Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3px-r7cr-r26r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:33:12.329Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:26.780Z"}}},"related_cves":[{"value":"CVE-2026-111908","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5eb3f021-14a0-4340-9133-6fbfcf5eadbf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111908","advisory_id":"5eb3f021-14a0-4340-9133-6fbfcf5eadbf","event_types":["advisory"],"published_at":"2026-10-25T11:36:29.876091+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:26.78+00:00","detail_url":"/advisories/advisory%3A5eb3f021-14a0-4340-9133-6fbfcf5eadbf","group":{"id":"advisory:5eb3f021-14a0-4340-9133-6fbfcf5eadbf","revision":1,"primary_event_id":41882,"change":"published","superseded_by":[],"changed":{"id":41882,"cve_ids":["CVE-2026-111908"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API","summary":"phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.","evidence":"cve:CVE-2026-111908","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111908","aliases":["CVE-2026-111908"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T21:33:12.329Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3px-r7cr-r26r","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-bola-in-faq-update-via-rest-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111908","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-19T21:32:52.162809Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3px-r7cr-r26r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:33:12.329Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:26.780Z"}}},"related_cves":[{"value":"CVE-2026-111908","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5eb3f021-14a0-4340-9133-6fbfcf5eadbf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111908","advisory_id":"5eb3f021-14a0-4340-9133-6fbfcf5eadbf","event_types":["advisory"],"published_at":"2026-10-25T11:36:29.876091+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:26.78+00:00","detail_url":"/events/41882"},"members":[{"id":41882,"cve_ids":["CVE-2026-111908"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API","summary":"phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.","evidence":"cve:CVE-2026-111908","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111908","aliases":["CVE-2026-111908"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T21:33:12.329Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3px-r7cr-r26r","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-bola-in-faq-update-via-rest-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111908","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-19T21:32:52.162809Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3px-r7cr-r26r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:33:12.329Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:26.780Z"}}},"related_cves":[{"value":"CVE-2026-111908","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5eb3f021-14a0-4340-9133-6fbfcf5eadbf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111908","advisory_id":"5eb3f021-14a0-4340-9133-6fbfcf5eadbf","event_types":["advisory"],"published_at":"2026-10-25T11:36:29.876091+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:26.78+00:00","detail_url":"/events/41882"}]}},{"id":42270,"cve_ids":["CVE-2026-111892"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.","evidence":"cve:CVE-2026-111892","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111892","aliases":["CVE-2026-111892"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T21:36:11.201Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-p2cj-r7vv-fr2r","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-rate-limiting-on-password-reset-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111892","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T21:35:45.395150Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-p2cj-r7vv-fr2r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:36:11.201Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:15.921Z"}}},"related_cves":[{"value":"CVE-2026-111892","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5dc41949-5c3f-4d9e-a68b-778e2429c6e4","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111892","advisory_id":"5dc41949-5c3f-4d9e-a68b-778e2429c6e4","event_types":["advisory"],"published_at":"2026-10-25T11:36:28.680436+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:15.921+00:00","detail_url":"/advisories/advisory%3A5dc41949-5c3f-4d9e-a68b-778e2429c6e4","group":{"id":"advisory:5dc41949-5c3f-4d9e-a68b-778e2429c6e4","revision":1,"primary_event_id":41881,"change":"published","superseded_by":[],"changed":{"id":41881,"cve_ids":["CVE-2026-111892"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.","evidence":"cve:CVE-2026-111892","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111892","aliases":["CVE-2026-111892"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T21:36:11.201Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-p2cj-r7vv-fr2r","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-rate-limiting-on-password-reset-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111892","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T21:35:45.395150Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-p2cj-r7vv-fr2r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:36:11.201Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:15.921Z"}}},"related_cves":[{"value":"CVE-2026-111892","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5dc41949-5c3f-4d9e-a68b-778e2429c6e4","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111892","advisory_id":"5dc41949-5c3f-4d9e-a68b-778e2429c6e4","event_types":["advisory"],"published_at":"2026-10-25T11:36:28.680436+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:15.921+00:00","detail_url":"/events/41881"},"members":[{"id":41881,"cve_ids":["CVE-2026-111892"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.","evidence":"cve:CVE-2026-111892","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111892","aliases":["CVE-2026-111892"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T21:36:11.201Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-p2cj-r7vv-fr2r","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-rate-limiting-on-password-reset-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111892","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T21:35:45.395150Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-p2cj-r7vv-fr2r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:36:11.201Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:15.921Z"}}},"related_cves":[{"value":"CVE-2026-111892","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5dc41949-5c3f-4d9e-a68b-778e2429c6e4","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111892","advisory_id":"5dc41949-5c3f-4d9e-a68b-778e2429c6e4","event_types":["advisory"],"published_at":"2026-10-25T11:36:28.680436+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:15.921+00:00","detail_url":"/events/41881"}]}},{"id":42223,"cve_ids":["CVE-2026-111903"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.","evidence":"cve:CVE-2026-111903","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111903","aliases":["CVE-2026-111903"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T21:30:45.472Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3v5-p957-w6gq","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-svg-dtd-entity-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111903","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T21:30:22.840465Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3v5-p957-w6gq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:30:45.472Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:23.442Z"}}},"related_cves":[{"value":"CVE-2026-111903","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f4709836-232b-4899-9e6a-5e20b34caa68","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111903","advisory_id":"f4709836-232b-4899-9e6a-5e20b34caa68","event_types":["advisory"],"published_at":"2026-10-25T11:26:32.955468+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:23.442+00:00","detail_url":"/advisories/advisory%3Af4709836-232b-4899-9e6a-5e20b34caa68","group":{"id":"advisory:f4709836-232b-4899-9e6a-5e20b34caa68","revision":1,"primary_event_id":41830,"change":"published","superseded_by":[],"changed":{"id":41830,"cve_ids":["CVE-2026-111903"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.","evidence":"cve:CVE-2026-111903","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111903","aliases":["CVE-2026-111903"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T21:30:45.472Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3v5-p957-w6gq","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-svg-dtd-entity-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111903","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T21:30:22.840465Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3v5-p957-w6gq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:30:45.472Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:23.442Z"}}},"related_cves":[{"value":"CVE-2026-111903","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f4709836-232b-4899-9e6a-5e20b34caa68","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111903","advisory_id":"f4709836-232b-4899-9e6a-5e20b34caa68","event_types":["advisory"],"published_at":"2026-10-25T11:26:32.955468+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:23.442+00:00","detail_url":"/events/41830"},"members":[{"id":41830,"cve_ids":["CVE-2026-111903"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.","evidence":"cve:CVE-2026-111903","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111903","aliases":["CVE-2026-111903"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T21:30:45.472Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3v5-p957-w6gq","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-svg-dtd-entity-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111903","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T21:30:22.840465Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3v5-p957-w6gq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:30:45.472Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:23.442Z"}}},"related_cves":[{"value":"CVE-2026-111903","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f4709836-232b-4899-9e6a-5e20b34caa68","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111903","advisory_id":"f4709836-232b-4899-9e6a-5e20b34caa68","event_types":["advisory"],"published_at":"2026-10-25T11:26:32.955468+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:23.442+00:00","detail_url":"/events/41830"}]}},{"id":42222,"cve_ids":["CVE-2026-111897"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.","evidence":"cve:CVE-2026-111897","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111897","aliases":["CVE-2026-111897"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T21:29:59.961Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hj8v-cg6r-gg6q","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-authorization-bypass-in-attachment-administration-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111897","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T21:29:37.474900Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hj8v-cg6r-gg6q","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:29:59.961Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:19.963Z"}}},"related_cves":[{"value":"CVE-2026-111897","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3407b943-140c-487e-820e-aff1db9f2f64","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111897","advisory_id":"3407b943-140c-487e-820e-aff1db9f2f64","event_types":["advisory"],"published_at":"2026-10-25T11:26:32.346203+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:19.963+00:00","detail_url":"/advisories/advisory%3A3407b943-140c-487e-820e-aff1db9f2f64","group":{"id":"advisory:3407b943-140c-487e-820e-aff1db9f2f64","revision":1,"primary_event_id":41829,"change":"published","superseded_by":[],"changed":{"id":41829,"cve_ids":["CVE-2026-111897"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.","evidence":"cve:CVE-2026-111897","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111897","aliases":["CVE-2026-111897"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T21:29:59.961Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hj8v-cg6r-gg6q","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-authorization-bypass-in-attachment-administration-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111897","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T21:29:37.474900Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hj8v-cg6r-gg6q","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:29:59.961Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:19.963Z"}}},"related_cves":[{"value":"CVE-2026-111897","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3407b943-140c-487e-820e-aff1db9f2f64","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111897","advisory_id":"3407b943-140c-487e-820e-aff1db9f2f64","event_types":["advisory"],"published_at":"2026-10-25T11:26:32.346203+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:19.963+00:00","detail_url":"/events/41829"},"members":[{"id":41829,"cve_ids":["CVE-2026-111897"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.","evidence":"cve:CVE-2026-111897","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111897","aliases":["CVE-2026-111897"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T21:29:59.961Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hj8v-cg6r-gg6q","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-authorization-bypass-in-attachment-administration-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111897","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T21:29:37.474900Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hj8v-cg6r-gg6q","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:29:59.961Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:19.963Z"}}},"related_cves":[{"value":"CVE-2026-111897","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3407b943-140c-487e-820e-aff1db9f2f64","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111897","advisory_id":"3407b943-140c-487e-820e-aff1db9f2f64","event_types":["advisory"],"published_at":"2026-10-25T11:26:32.346203+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:19.963+00:00","detail_url":"/events/41829"}]}},{"id":39324,"cve_ids":["CVE-2026-111896"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass","summary":"phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.","evidence":"cve:CVE-2026-111896","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111896","aliases":["CVE-2026-111896"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T16:40:09.249Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-95fm-rwq4-rxrf","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-svg-upload-sanitizer-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111896","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T15:35:29.126672Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T16:40:09.249Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:19.253Z"}}},"related_cves":[{"value":"CVE-2026-111896","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e1af8888-0e58-4d91-81a2-461bd6e6a77a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111896","advisory_id":"e1af8888-0e58-4d91-81a2-461bd6e6a77a","event_types":["advisory"],"published_at":"2026-10-25T10:38:28.975466+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:19.253+00:00","detail_url":"/advisories/advisory%3Ae1af8888-0e58-4d91-81a2-461bd6e6a77a","group":{"id":"advisory:e1af8888-0e58-4d91-81a2-461bd6e6a77a","revision":1,"primary_event_id":38969,"change":"published","superseded_by":[],"changed":{"id":38969,"cve_ids":["CVE-2026-111896"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass","summary":"phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.","evidence":"cve:CVE-2026-111896","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111896","aliases":["CVE-2026-111896"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T16:40:09.249Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-95fm-rwq4-rxrf","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-svg-upload-sanitizer-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111896","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T15:35:29.126672Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T16:40:09.249Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:19.253Z"}}},"related_cves":[{"value":"CVE-2026-111896","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e1af8888-0e58-4d91-81a2-461bd6e6a77a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111896","advisory_id":"e1af8888-0e58-4d91-81a2-461bd6e6a77a","event_types":["advisory"],"published_at":"2026-10-25T10:38:28.975466+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:19.253+00:00","detail_url":"/events/38969"},"members":[{"id":38969,"cve_ids":["CVE-2026-111896"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass","summary":"phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.","evidence":"cve:CVE-2026-111896","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111896","aliases":["CVE-2026-111896"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T16:40:09.249Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-95fm-rwq4-rxrf","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-svg-upload-sanitizer-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111896","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T15:35:29.126672Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T16:40:09.249Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:19.253Z"}}},"related_cves":[{"value":"CVE-2026-111896","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e1af8888-0e58-4d91-81a2-461bd6e6a77a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111896","advisory_id":"e1af8888-0e58-4d91-81a2-461bd6e6a77a","event_types":["advisory"],"published_at":"2026-10-25T10:38:28.975466+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:19.253+00:00","detail_url":"/events/38969"}]}},{"id":39323,"cve_ids":["CVE-2026-111907"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database","summary":"phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.","evidence":"cve:CVE-2026-111907","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111907","aliases":["CVE-2026-111907"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T16:39:51.053Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6x9g-rfx8-g42q","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-csrf-via-admin-api-update-database"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111907","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T15:42:26.867038Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T16:39:51.053Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:26.117Z"}}},"related_cves":[{"value":"CVE-2026-111907","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ddc94c96-491a-4236-a1f2-0fc1ef6e282b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111907","advisory_id":"ddc94c96-491a-4236-a1f2-0fc1ef6e282b","event_types":["advisory"],"published_at":"2026-10-25T10:38:28.337537+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:26.117+00:00","detail_url":"/advisories/advisory%3Addc94c96-491a-4236-a1f2-0fc1ef6e282b","group":{"id":"advisory:ddc94c96-491a-4236-a1f2-0fc1ef6e282b","revision":1,"primary_event_id":38968,"change":"published","superseded_by":[],"changed":{"id":38968,"cve_ids":["CVE-2026-111907"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database","summary":"phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.","evidence":"cve:CVE-2026-111907","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111907","aliases":["CVE-2026-111907"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T16:39:51.053Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6x9g-rfx8-g42q","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-csrf-via-admin-api-update-database"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111907","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T15:42:26.867038Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T16:39:51.053Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:26.117Z"}}},"related_cves":[{"value":"CVE-2026-111907","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ddc94c96-491a-4236-a1f2-0fc1ef6e282b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111907","advisory_id":"ddc94c96-491a-4236-a1f2-0fc1ef6e282b","event_types":["advisory"],"published_at":"2026-10-25T10:38:28.337537+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:26.117+00:00","detail_url":"/events/38968"},"members":[{"id":38968,"cve_ids":["CVE-2026-111907"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database","summary":"phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.","evidence":"cve:CVE-2026-111907","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111907","aliases":["CVE-2026-111907"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T16:39:51.053Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6x9g-rfx8-g42q","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-csrf-via-admin-api-update-database"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111907","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T15:42:26.867038Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T16:39:51.053Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:26.117Z"}}},"related_cves":[{"value":"CVE-2026-111907","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ddc94c96-491a-4236-a1f2-0fc1ef6e282b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111907","advisory_id":"ddc94c96-491a-4236-a1f2-0fc1ef6e282b","event_types":["advisory"],"published_at":"2026-10-25T10:38:28.337537+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:26.117+00:00","detail_url":"/events/38968"}]}},{"id":39322,"cve_ids":["CVE-2026-111902"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs.","evidence":"cve:CVE-2026-111902","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111902","aliases":["CVE-2026-111902"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T16:39:57.712Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6fj-8cjr-wrxv","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-authorization-bypass-via-comments-and-attachments-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111902","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T15:42:25.322857Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T16:39:57.712Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:22.764Z"}}},"related_cves":[{"value":"CVE-2026-111902","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f0634987-f01b-4832-acdf-b5f5090ec39f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111902","advisory_id":"f0634987-f01b-4832-acdf-b5f5090ec39f","event_types":["advisory"],"published_at":"2026-10-25T10:38:27.712542+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:22.764+00:00","detail_url":"/advisories/advisory%3Af0634987-f01b-4832-acdf-b5f5090ec39f","group":{"id":"advisory:f0634987-f01b-4832-acdf-b5f5090ec39f","revision":1,"primary_event_id":38967,"change":"published","superseded_by":[],"changed":{"id":38967,"cve_ids":["CVE-2026-111902"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs.","evidence":"cve:CVE-2026-111902","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111902","aliases":["CVE-2026-111902"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T16:39:57.712Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6fj-8cjr-wrxv","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-authorization-bypass-via-comments-and-attachments-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111902","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T15:42:25.322857Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T16:39:57.712Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:22.764Z"}}},"related_cves":[{"value":"CVE-2026-111902","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f0634987-f01b-4832-acdf-b5f5090ec39f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111902","advisory_id":"f0634987-f01b-4832-acdf-b5f5090ec39f","event_types":["advisory"],"published_at":"2026-10-25T10:38:27.712542+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:22.764+00:00","detail_url":"/events/38967"},"members":[{"id":38967,"cve_ids":["CVE-2026-111902"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs.","evidence":"cve:CVE-2026-111902","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111902","aliases":["CVE-2026-111902"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T16:39:57.712Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6fj-8cjr-wrxv","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-authorization-bypass-via-comments-and-attachments-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111902","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T15:42:25.322857Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T16:39:57.712Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:22.764Z"}}},"related_cves":[{"value":"CVE-2026-111902","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f0634987-f01b-4832-acdf-b5f5090ec39f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111902","advisory_id":"f0634987-f01b-4832-acdf-b5f5090ec39f","event_types":["advisory"],"published_at":"2026-10-25T10:38:27.712542+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:22.764+00:00","detail_url":"/events/38967"}]}},{"id":39321,"cve_ids":["CVE-2026-111891"],"payload":{"kind":"advisory","title":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.","evidence":"cve:CVE-2026-111891","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111891","aliases":["CVE-2026-111891"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha.2","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T16:40:19.217Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6vf7-mrj2-7c37","https://www.vulncheck.com/advisories/phpmyfaq-from-4.2.0-alpha.2-before-4.2.0-beta-privilege-escalation-via-group-permissions-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111891","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T15:35:26.238696Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T16:40:19.217Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:15.227Z"}}},"related_cves":[{"value":"CVE-2026-111891","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7a7d239f-e09d-4234-8aa2-6523f812b189","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111891","advisory_id":"7a7d239f-e09d-4234-8aa2-6523f812b189","event_types":["advisory"],"published_at":"2026-10-25T10:38:27.080047+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:15.227+00:00","detail_url":"/advisories/advisory%3A7a7d239f-e09d-4234-8aa2-6523f812b189","group":{"id":"advisory:7a7d239f-e09d-4234-8aa2-6523f812b189","revision":1,"primary_event_id":38966,"change":"published","superseded_by":[],"changed":{"id":38966,"cve_ids":["CVE-2026-111891"],"payload":{"kind":"advisory","title":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.","evidence":"cve:CVE-2026-111891","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111891","aliases":["CVE-2026-111891"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha.2","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T16:40:19.217Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6vf7-mrj2-7c37","https://www.vulncheck.com/advisories/phpmyfaq-from-4.2.0-alpha.2-before-4.2.0-beta-privilege-escalation-via-group-permissions-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111891","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T15:35:26.238696Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T16:40:19.217Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:15.227Z"}}},"related_cves":[{"value":"CVE-2026-111891","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7a7d239f-e09d-4234-8aa2-6523f812b189","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111891","advisory_id":"7a7d239f-e09d-4234-8aa2-6523f812b189","event_types":["advisory"],"published_at":"2026-10-25T10:38:27.080047+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:15.227+00:00","detail_url":"/events/38966"},"members":[{"id":38966,"cve_ids":["CVE-2026-111891"],"payload":{"kind":"advisory","title":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.","evidence":"cve:CVE-2026-111891","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111891","aliases":["CVE-2026-111891"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha.2","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T16:40:19.217Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6vf7-mrj2-7c37","https://www.vulncheck.com/advisories/phpmyfaq-from-4.2.0-alpha.2-before-4.2.0-beta-privilege-escalation-via-group-permissions-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111891","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T15:35:26.238696Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T16:40:19.217Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:15.227Z"}}},"related_cves":[{"value":"CVE-2026-111891","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7a7d239f-e09d-4234-8aa2-6523f812b189","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111891","advisory_id":"7a7d239f-e09d-4234-8aa2-6523f812b189","event_types":["advisory"],"published_at":"2026-10-25T10:38:27.080047+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:15.227+00:00","detail_url":"/events/38966"}]}},{"id":39264,"cve_ids":["CVE-2026-111911"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection","summary":"phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.","evidence":"cve:CVE-2026-111911","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-111911","aliases":["CVE-2026-111911"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:54:32.100Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credential-injection"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111911","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-19T14:53:36.845015Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:54:32.100Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:28.833Z"}}},"related_cves":[{"value":"CVE-2026-111911","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c1b3ab00-17af-487e-b6ef-87bb9893dcb4","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111911","advisory_id":"c1b3ab00-17af-487e-b6ef-87bb9893dcb4","event_types":["advisory"],"published_at":"2026-10-25T10:37:50.594052+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:28.833+00:00","detail_url":"/advisories/advisory%3Ac1b3ab00-17af-487e-b6ef-87bb9893dcb4","group":{"id":"advisory:c1b3ab00-17af-487e-b6ef-87bb9893dcb4","revision":1,"primary_event_id":38909,"change":"published","superseded_by":[],"changed":{"id":38909,"cve_ids":["CVE-2026-111911"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection","summary":"phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.","evidence":"cve:CVE-2026-111911","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-111911","aliases":["CVE-2026-111911"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:54:32.100Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credential-injection"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111911","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-19T14:53:36.845015Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:54:32.100Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:28.833Z"}}},"related_cves":[{"value":"CVE-2026-111911","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c1b3ab00-17af-487e-b6ef-87bb9893dcb4","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111911","advisory_id":"c1b3ab00-17af-487e-b6ef-87bb9893dcb4","event_types":["advisory"],"published_at":"2026-10-25T10:37:50.594052+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:28.833+00:00","detail_url":"/events/38909"},"members":[{"id":38909,"cve_ids":["CVE-2026-111911"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection","summary":"phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.","evidence":"cve:CVE-2026-111911","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-111911","aliases":["CVE-2026-111911"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:54:32.100Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credential-injection"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111911","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-19T14:53:36.845015Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:54:32.100Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:28.833Z"}}},"related_cves":[{"value":"CVE-2026-111911","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c1b3ab00-17af-487e-b6ef-87bb9893dcb4","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111911","advisory_id":"c1b3ab00-17af-487e-b6ef-87bb9893dcb4","event_types":["advisory"],"published_at":"2026-10-25T10:37:50.594052+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:28.833+00:00","detail_url":"/events/38909"}]}},{"id":39263,"cve_ids":["CVE-2026-111906"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.","evidence":"cve:CVE-2026-111906","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111906","aliases":["CVE-2026-111906"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:52:20.126Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-cmvh-fpmf-8gfx","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-csrf-in-elasticsearch-opensearch-admin-api-index-operations"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111906","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T14:51:35.725667Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-cmvh-fpmf-8gfx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:52:20.126Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:25.460Z"}}},"related_cves":[{"value":"CVE-2026-111906","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:80eeefd3-4793-43b2-9858-706bc912a9a8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111906","advisory_id":"80eeefd3-4793-43b2-9858-706bc912a9a8","event_types":["advisory"],"published_at":"2026-10-25T10:37:49.97904+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:25.46+00:00","detail_url":"/advisories/advisory%3A80eeefd3-4793-43b2-9858-706bc912a9a8","group":{"id":"advisory:80eeefd3-4793-43b2-9858-706bc912a9a8","revision":1,"primary_event_id":38908,"change":"published","superseded_by":[],"changed":{"id":38908,"cve_ids":["CVE-2026-111906"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.","evidence":"cve:CVE-2026-111906","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111906","aliases":["CVE-2026-111906"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:52:20.126Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-cmvh-fpmf-8gfx","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-csrf-in-elasticsearch-opensearch-admin-api-index-operations"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111906","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T14:51:35.725667Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-cmvh-fpmf-8gfx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:52:20.126Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:25.460Z"}}},"related_cves":[{"value":"CVE-2026-111906","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:80eeefd3-4793-43b2-9858-706bc912a9a8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111906","advisory_id":"80eeefd3-4793-43b2-9858-706bc912a9a8","event_types":["advisory"],"published_at":"2026-10-25T10:37:49.97904+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:25.46+00:00","detail_url":"/events/38908"},"members":[{"id":38908,"cve_ids":["CVE-2026-111906"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.","evidence":"cve:CVE-2026-111906","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111906","aliases":["CVE-2026-111906"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:52:20.126Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-cmvh-fpmf-8gfx","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-csrf-in-elasticsearch-opensearch-admin-api-index-operations"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111906","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T14:51:35.725667Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-cmvh-fpmf-8gfx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:52:20.126Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:25.460Z"}}},"related_cves":[{"value":"CVE-2026-111906","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:80eeefd3-4793-43b2-9858-706bc912a9a8","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111906","advisory_id":"80eeefd3-4793-43b2-9858-706bc912a9a8","event_types":["advisory"],"published_at":"2026-10-25T10:37:49.97904+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:25.46+00:00","detail_url":"/events/38908"}]}},{"id":39261,"cve_ids":["CVE-2026-111901"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.","evidence":"cve:CVE-2026-111901","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111901","aliases":["CVE-2026-111901"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:50:09.039Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111901","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T14:47:41.800023Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:50:09.039Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:22.075Z"}}},"related_cves":[{"value":"CVE-2026-111901","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:044235d6-60d7-42b4-a1e9-22e93844ae8d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111901","advisory_id":"044235d6-60d7-42b4-a1e9-22e93844ae8d","event_types":["advisory"],"published_at":"2026-10-25T10:37:48.70185+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:22.075+00:00","detail_url":"/advisories/advisory%3A044235d6-60d7-42b4-a1e9-22e93844ae8d","group":{"id":"advisory:044235d6-60d7-42b4-a1e9-22e93844ae8d","revision":1,"primary_event_id":38906,"change":"published","superseded_by":[],"changed":{"id":38906,"cve_ids":["CVE-2026-111901"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.","evidence":"cve:CVE-2026-111901","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111901","aliases":["CVE-2026-111901"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:50:09.039Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111901","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T14:47:41.800023Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:50:09.039Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:22.075Z"}}},"related_cves":[{"value":"CVE-2026-111901","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:044235d6-60d7-42b4-a1e9-22e93844ae8d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111901","advisory_id":"044235d6-60d7-42b4-a1e9-22e93844ae8d","event_types":["advisory"],"published_at":"2026-10-25T10:37:48.70185+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:22.075+00:00","detail_url":"/events/38906"},"members":[{"id":38906,"cve_ids":["CVE-2026-111901"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.","evidence":"cve:CVE-2026-111901","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111901","aliases":["CVE-2026-111901"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:50:09.039Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111901","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T14:47:41.800023Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:50:09.039Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:22.075Z"}}},"related_cves":[{"value":"CVE-2026-111901","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:044235d6-60d7-42b4-a1e9-22e93844ae8d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111901","advisory_id":"044235d6-60d7-42b4-a1e9-22e93844ae8d","event_types":["advisory"],"published_at":"2026-10-25T10:37:48.70185+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:22.075+00:00","detail_url":"/events/38906"}]}},{"id":39258,"cve_ids":["CVE-2026-111895"],"payload":{"kind":"advisory","title":"phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username","summary":"phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.","evidence":"cve:CVE-2026-111895","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111895","aliases":["CVE-2026-111895"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"3.2.0","lessThan":"4.0.0","versionType":"semver"},{"status":"unaffected","version":"4.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.2","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:46:24.561Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6hhv-gc4g-f4r7","https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-before-4.0.0-and-4.0.2-before-4.2.0-beta-account-takeover-via-entra-id-preferred-username"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111895","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-19T14:44:53.067202Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6hhv-gc4g-f4r7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:46:24.561Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:18.581Z"}}},"related_cves":[{"value":"CVE-2026-111895","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:192c9abc-dbaa-42b8-ba9b-54770172cef3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111895","advisory_id":"192c9abc-dbaa-42b8-ba9b-54770172cef3","event_types":["advisory"],"published_at":"2026-10-25T10:37:46.805058+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:18.581+00:00","detail_url":"/advisories/advisory%3A192c9abc-dbaa-42b8-ba9b-54770172cef3","group":{"id":"advisory:192c9abc-dbaa-42b8-ba9b-54770172cef3","revision":1,"primary_event_id":38903,"change":"published","superseded_by":[],"changed":{"id":38903,"cve_ids":["CVE-2026-111895"],"payload":{"kind":"advisory","title":"phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username","summary":"phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.","evidence":"cve:CVE-2026-111895","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111895","aliases":["CVE-2026-111895"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"3.2.0","lessThan":"4.0.0","versionType":"semver"},{"status":"unaffected","version":"4.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.2","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:46:24.561Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6hhv-gc4g-f4r7","https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-before-4.0.0-and-4.0.2-before-4.2.0-beta-account-takeover-via-entra-id-preferred-username"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111895","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-19T14:44:53.067202Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6hhv-gc4g-f4r7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:46:24.561Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:18.581Z"}}},"related_cves":[{"value":"CVE-2026-111895","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:192c9abc-dbaa-42b8-ba9b-54770172cef3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111895","advisory_id":"192c9abc-dbaa-42b8-ba9b-54770172cef3","event_types":["advisory"],"published_at":"2026-10-25T10:37:46.805058+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:18.581+00:00","detail_url":"/events/38903"},"members":[{"id":38903,"cve_ids":["CVE-2026-111895"],"payload":{"kind":"advisory","title":"phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username","summary":"phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.","evidence":"cve:CVE-2026-111895","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111895","aliases":["CVE-2026-111895"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"3.2.0","lessThan":"4.0.0","versionType":"semver"},{"status":"unaffected","version":"4.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.2","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:46:24.561Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6hhv-gc4g-f4r7","https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-before-4.0.0-and-4.0.2-before-4.2.0-beta-account-takeover-via-entra-id-preferred-username"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111895","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-19T14:44:53.067202Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6hhv-gc4g-f4r7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:46:24.561Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:18.581Z"}}},"related_cves":[{"value":"CVE-2026-111895","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:192c9abc-dbaa-42b8-ba9b-54770172cef3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111895","advisory_id":"192c9abc-dbaa-42b8-ba9b-54770172cef3","event_types":["advisory"],"published_at":"2026-10-25T10:37:46.805058+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:18.581+00:00","detail_url":"/events/38903"}]}},{"id":39257,"cve_ids":["CVE-2026-111890"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.","evidence":"cve:CVE-2026-111890","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111890","aliases":["CVE-2026-111890"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha.2","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:43:14.146Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-privilege-escalation-via-updateuserrights"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111890","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T14:42:09.090980Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:43:14.146Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:14.542Z"}}},"related_cves":[{"value":"CVE-2026-111890","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dd07b579-db33-4c91-b10f-240f9f6b2f01","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111890","advisory_id":"dd07b579-db33-4c91-b10f-240f9f6b2f01","event_types":["advisory"],"published_at":"2026-10-25T10:37:46.010303+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:14.542+00:00","detail_url":"/advisories/advisory%3Add07b579-db33-4c91-b10f-240f9f6b2f01","group":{"id":"advisory:dd07b579-db33-4c91-b10f-240f9f6b2f01","revision":1,"primary_event_id":38902,"change":"published","superseded_by":[],"changed":{"id":38902,"cve_ids":["CVE-2026-111890"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.","evidence":"cve:CVE-2026-111890","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111890","aliases":["CVE-2026-111890"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha.2","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:43:14.146Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-privilege-escalation-via-updateuserrights"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111890","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T14:42:09.090980Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:43:14.146Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:14.542Z"}}},"related_cves":[{"value":"CVE-2026-111890","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dd07b579-db33-4c91-b10f-240f9f6b2f01","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111890","advisory_id":"dd07b579-db33-4c91-b10f-240f9f6b2f01","event_types":["advisory"],"published_at":"2026-10-25T10:37:46.010303+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:14.542+00:00","detail_url":"/events/38902"},"members":[{"id":38902,"cve_ids":["CVE-2026-111890"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.","evidence":"cve:CVE-2026-111890","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111890","aliases":["CVE-2026-111890"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha.2","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-19T14:43:14.146Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-privilege-escalation-via-updateuserrights"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111890","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T14:42:09.090980Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:43:14.146Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:14.542Z"}}},"related_cves":[{"value":"CVE-2026-111890","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dd07b579-db33-4c91-b10f-240f9f6b2f01","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111890","advisory_id":"dd07b579-db33-4c91-b10f-240f9f6b2f01","event_types":["advisory"],"published_at":"2026-10-25T10:37:46.010303+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:14.542+00:00","detail_url":"/events/38902"}]}},{"id":35023,"cve_ids":["CVE-2026-111889"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard","summary":"phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.","evidence":"cve:CVE-2026-111889","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111889","aliases":["CVE-2026-111889"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.1.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T13:26:41.571Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4378-pcwq-fc29","https://www.vulncheck.com/advisories/phpmyfaq-4.1.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-admin-dashboard"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111889","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T13:26:27.189859Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4378-pcwq-fc29","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T13:26:41.571Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:13.883Z"}}},"related_cves":[{"value":"CVE-2026-111889","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:062add18-5aaf-4167-91e6-d3a95315ff8f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111889","advisory_id":"062add18-5aaf-4167-91e6-d3a95315ff8f","event_types":["advisory"],"published_at":"2026-10-25T09:27:45.637397+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:13.883+00:00","detail_url":"/advisories/advisory%3A062add18-5aaf-4167-91e6-d3a95315ff8f","group":{"id":"advisory:062add18-5aaf-4167-91e6-d3a95315ff8f","revision":1,"primary_event_id":34726,"change":"published","superseded_by":[],"changed":{"id":34726,"cve_ids":["CVE-2026-111889"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard","summary":"phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.","evidence":"cve:CVE-2026-111889","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111889","aliases":["CVE-2026-111889"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.1.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T13:26:41.571Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4378-pcwq-fc29","https://www.vulncheck.com/advisories/phpmyfaq-4.1.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-admin-dashboard"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111889","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T13:26:27.189859Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4378-pcwq-fc29","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T13:26:41.571Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:13.883Z"}}},"related_cves":[{"value":"CVE-2026-111889","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:062add18-5aaf-4167-91e6-d3a95315ff8f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111889","advisory_id":"062add18-5aaf-4167-91e6-d3a95315ff8f","event_types":["advisory"],"published_at":"2026-10-25T09:27:45.637397+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:13.883+00:00","detail_url":"/events/34726"},"members":[{"id":34726,"cve_ids":["CVE-2026-111889"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard","summary":"phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.","evidence":"cve:CVE-2026-111889","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111889","aliases":["CVE-2026-111889"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.1.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T13:26:41.571Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4378-pcwq-fc29","https://www.vulncheck.com/advisories/phpmyfaq-4.1.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-admin-dashboard"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111889","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T13:26:27.189859Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4378-pcwq-fc29","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T13:26:41.571Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:13.883Z"}}},"related_cves":[{"value":"CVE-2026-111889","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:062add18-5aaf-4167-91e6-d3a95315ff8f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111889","advisory_id":"062add18-5aaf-4167-91e6-d3a95315ff8f","event_types":["advisory"],"published_at":"2026-10-25T09:27:45.637397+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:13.883+00:00","detail_url":"/events/34726"}]}},{"id":35022,"cve_ids":["CVE-2026-111887"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.","evidence":"cve:CVE-2026-111887","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111887","aliases":["CVE-2026-111887"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T13:26:01.243Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgxw-7c68-83w7","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-account-enumeration-via-guest-comment-endpoint"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111887","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T13:25:45.982560Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgxw-7c68-83w7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T13:26:01.243Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:12.494Z"}}},"related_cves":[{"value":"CVE-2026-111887","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:80dcdd3b-d802-4c0f-b35f-477492fd7f1d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111887","advisory_id":"80dcdd3b-d802-4c0f-b35f-477492fd7f1d","event_types":["advisory"],"published_at":"2026-10-25T09:27:45.019697+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:12.494+00:00","detail_url":"/advisories/advisory%3A80dcdd3b-d802-4c0f-b35f-477492fd7f1d","group":{"id":"advisory:80dcdd3b-d802-4c0f-b35f-477492fd7f1d","revision":1,"primary_event_id":34725,"change":"published","superseded_by":[],"changed":{"id":34725,"cve_ids":["CVE-2026-111887"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.","evidence":"cve:CVE-2026-111887","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111887","aliases":["CVE-2026-111887"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T13:26:01.243Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgxw-7c68-83w7","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-account-enumeration-via-guest-comment-endpoint"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111887","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T13:25:45.982560Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgxw-7c68-83w7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T13:26:01.243Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:12.494Z"}}},"related_cves":[{"value":"CVE-2026-111887","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:80dcdd3b-d802-4c0f-b35f-477492fd7f1d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111887","advisory_id":"80dcdd3b-d802-4c0f-b35f-477492fd7f1d","event_types":["advisory"],"published_at":"2026-10-25T09:27:45.019697+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:12.494+00:00","detail_url":"/events/34725"},"members":[{"id":34725,"cve_ids":["CVE-2026-111887"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.","evidence":"cve:CVE-2026-111887","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111887","aliases":["CVE-2026-111887"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T13:26:01.243Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgxw-7c68-83w7","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-account-enumeration-via-guest-comment-endpoint"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111887","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T13:25:45.982560Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgxw-7c68-83w7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T13:26:01.243Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:12.494Z"}}},"related_cves":[{"value":"CVE-2026-111887","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:80dcdd3b-d802-4c0f-b35f-477492fd7f1d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111887","advisory_id":"80dcdd3b-d802-4c0f-b35f-477492fd7f1d","event_types":["advisory"],"published_at":"2026-10-25T09:27:45.019697+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:12.494+00:00","detail_url":"/events/34725"}]}},{"id":35021,"cve_ids":["CVE-2026-111886"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.","evidence":"cve:CVE-2026-111886","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111886","aliases":["CVE-2026-111886"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha.2","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T13:25:20.125Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7pjw-6v4g-f837","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-2fa-brute-force-via-remove-twofactor-endpoint"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111886","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T13:25:03.538773Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7pjw-6v4g-f837","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T13:25:20.125Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:11.821Z"}}},"related_cves":[{"value":"CVE-2026-111886","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2120bf0f-a1ca-4dbe-884e-24929125a56f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111886","advisory_id":"2120bf0f-a1ca-4dbe-884e-24929125a56f","event_types":["advisory"],"published_at":"2026-10-25T09:27:44.356901+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:11.821+00:00","detail_url":"/advisories/advisory%3A2120bf0f-a1ca-4dbe-884e-24929125a56f","group":{"id":"advisory:2120bf0f-a1ca-4dbe-884e-24929125a56f","revision":1,"primary_event_id":34724,"change":"published","superseded_by":[],"changed":{"id":34724,"cve_ids":["CVE-2026-111886"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.","evidence":"cve:CVE-2026-111886","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111886","aliases":["CVE-2026-111886"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha.2","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T13:25:20.125Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7pjw-6v4g-f837","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-2fa-brute-force-via-remove-twofactor-endpoint"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111886","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T13:25:03.538773Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7pjw-6v4g-f837","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T13:25:20.125Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:11.821Z"}}},"related_cves":[{"value":"CVE-2026-111886","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2120bf0f-a1ca-4dbe-884e-24929125a56f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111886","advisory_id":"2120bf0f-a1ca-4dbe-884e-24929125a56f","event_types":["advisory"],"published_at":"2026-10-25T09:27:44.356901+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:11.821+00:00","detail_url":"/events/34724"},"members":[{"id":34724,"cve_ids":["CVE-2026-111886"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.","evidence":"cve:CVE-2026-111886","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111886","aliases":["CVE-2026-111886"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha.2","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T13:25:20.125Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7pjw-6v4g-f837","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-2fa-brute-force-via-remove-twofactor-endpoint"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111886","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T13:25:03.538773Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7pjw-6v4g-f837","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T13:25:20.125Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:11.821Z"}}},"related_cves":[{"value":"CVE-2026-111886","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2120bf0f-a1ca-4dbe-884e-24929125a56f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111886","advisory_id":"2120bf0f-a1ca-4dbe-884e-24929125a56f","event_types":["advisory"],"published_at":"2026-10-25T09:27:44.356901+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:11.821+00:00","detail_url":"/events/34724"}]}},{"id":35020,"cve_ids":["CVE-2026-111885"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API","summary":"phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.","evidence":"cve:CVE-2026-111885","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111885","aliases":["CVE-2026-111885"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T13:24:35.633Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-deletegroup-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111885","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T13:24:16.934638Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T13:24:35.633Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:11.116Z"}}},"related_cves":[{"value":"CVE-2026-111885","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:646c9e04-4813-4d76-a649-1d30417aaa20","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111885","advisory_id":"646c9e04-4813-4d76-a649-1d30417aaa20","event_types":["advisory"],"published_at":"2026-10-25T09:27:43.718367+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:11.116+00:00","detail_url":"/advisories/advisory%3A646c9e04-4813-4d76-a649-1d30417aaa20","group":{"id":"advisory:646c9e04-4813-4d76-a649-1d30417aaa20","revision":1,"primary_event_id":34723,"change":"published","superseded_by":[],"changed":{"id":34723,"cve_ids":["CVE-2026-111885"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API","summary":"phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.","evidence":"cve:CVE-2026-111885","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111885","aliases":["CVE-2026-111885"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T13:24:35.633Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-deletegroup-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111885","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T13:24:16.934638Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T13:24:35.633Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:11.116Z"}}},"related_cves":[{"value":"CVE-2026-111885","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:646c9e04-4813-4d76-a649-1d30417aaa20","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111885","advisory_id":"646c9e04-4813-4d76-a649-1d30417aaa20","event_types":["advisory"],"published_at":"2026-10-25T09:27:43.718367+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:11.116+00:00","detail_url":"/events/34723"},"members":[{"id":34723,"cve_ids":["CVE-2026-111885"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API","summary":"phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.","evidence":"cve:CVE-2026-111885","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111885","aliases":["CVE-2026-111885"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T13:24:35.633Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-deletegroup-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111885","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T13:24:16.934638Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T13:24:35.633Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:11.116Z"}}},"related_cves":[{"value":"CVE-2026-111885","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:646c9e04-4813-4d76-a649-1d30417aaa20","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111885","advisory_id":"646c9e04-4813-4d76-a649-1d30417aaa20","event_types":["advisory"],"published_at":"2026-10-25T09:27:43.718367+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:11.116+00:00","detail_url":"/events/34723"}]}},{"id":35009,"cve_ids":["CVE-2026-111884"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.","evidence":"cve:CVE-2026-111884","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111884","aliases":["CVE-2026-111884"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:18:30.268Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7554-gx6g-xx77","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-missing-current-password-step-up-on-e-mail-change-enables-account-takeover"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111884","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T12:18:27.710495Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7554-gx6g-xx77","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:18:30.268Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:10.426Z"}}},"related_cves":[{"value":"CVE-2026-111884","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4360c548-473d-4018-8e7c-385379e3a10b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111884","advisory_id":"4360c548-473d-4018-8e7c-385379e3a10b","event_types":["advisory"],"published_at":"2026-10-25T09:27:36.192992+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:10.426+00:00","detail_url":"/advisories/advisory%3A4360c548-473d-4018-8e7c-385379e3a10b","group":{"id":"advisory:4360c548-473d-4018-8e7c-385379e3a10b","revision":1,"primary_event_id":34712,"change":"published","superseded_by":[],"changed":{"id":34712,"cve_ids":["CVE-2026-111884"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.","evidence":"cve:CVE-2026-111884","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111884","aliases":["CVE-2026-111884"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:18:30.268Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7554-gx6g-xx77","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-missing-current-password-step-up-on-e-mail-change-enables-account-takeover"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111884","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T12:18:27.710495Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7554-gx6g-xx77","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:18:30.268Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:10.426Z"}}},"related_cves":[{"value":"CVE-2026-111884","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4360c548-473d-4018-8e7c-385379e3a10b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111884","advisory_id":"4360c548-473d-4018-8e7c-385379e3a10b","event_types":["advisory"],"published_at":"2026-10-25T09:27:36.192992+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:10.426+00:00","detail_url":"/events/34712"},"members":[{"id":34712,"cve_ids":["CVE-2026-111884"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover","summary":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.","evidence":"cve:CVE-2026-111884","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111884","aliases":["CVE-2026-111884"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:18:30.268Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7554-gx6g-xx77","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-missing-current-password-step-up-on-e-mail-change-enables-account-takeover"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111884","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T12:18:27.710495Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7554-gx6g-xx77","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:18:30.268Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:10.426Z"}}},"related_cves":[{"value":"CVE-2026-111884","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4360c548-473d-4018-8e7c-385379e3a10b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111884","advisory_id":"4360c548-473d-4018-8e7c-385379e3a10b","event_types":["advisory"],"published_at":"2026-10-25T09:27:36.192992+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:10.426+00:00","detail_url":"/events/34712"}]}},{"id":35008,"cve_ids":["CVE-2026-111882"],"payload":{"kind":"advisory","title":"phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks","summary":"phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.","evidence":"cve:CVE-2026-111882","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111882","aliases":["CVE-2026-111882"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"3.2.0-alpha","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:32.006Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-43g3-pp5p-fg96","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8fvf-747v-qjr6","https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-alpha-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-totp-2fa-bypass-via-sso-callbacks"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111882","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T12:17:54.583401Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:32.006Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:09.750Z"}}},"related_cves":[{"value":"CVE-2026-111882","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dac1be36-4963-4845-bbba-c3751dd5aedf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111882","advisory_id":"dac1be36-4963-4845-bbba-c3751dd5aedf","event_types":["advisory"],"published_at":"2026-10-25T09:27:35.479231+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:09.75+00:00","detail_url":"/advisories/advisory%3Adac1be36-4963-4845-bbba-c3751dd5aedf","group":{"id":"advisory:dac1be36-4963-4845-bbba-c3751dd5aedf","revision":1,"primary_event_id":34711,"change":"published","superseded_by":[],"changed":{"id":34711,"cve_ids":["CVE-2026-111882"],"payload":{"kind":"advisory","title":"phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks","summary":"phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.","evidence":"cve:CVE-2026-111882","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111882","aliases":["CVE-2026-111882"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"3.2.0-alpha","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:32.006Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-43g3-pp5p-fg96","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8fvf-747v-qjr6","https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-alpha-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-totp-2fa-bypass-via-sso-callbacks"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111882","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T12:17:54.583401Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:32.006Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:09.750Z"}}},"related_cves":[{"value":"CVE-2026-111882","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dac1be36-4963-4845-bbba-c3751dd5aedf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111882","advisory_id":"dac1be36-4963-4845-bbba-c3751dd5aedf","event_types":["advisory"],"published_at":"2026-10-25T09:27:35.479231+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:09.75+00:00","detail_url":"/events/34711"},"members":[{"id":34711,"cve_ids":["CVE-2026-111882"],"payload":{"kind":"advisory","title":"phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks","summary":"phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.","evidence":"cve:CVE-2026-111882","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111882","aliases":["CVE-2026-111882"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"3.2.0-alpha","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"},{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:32.006Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-43g3-pp5p-fg96","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8fvf-747v-qjr6","https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-alpha-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-totp-2fa-bypass-via-sso-callbacks"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111882","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T12:17:54.583401Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:32.006Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:09.750Z"}}},"related_cves":[{"value":"CVE-2026-111882","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dac1be36-4963-4845-bbba-c3751dd5aedf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111882","advisory_id":"dac1be36-4963-4845-bbba-c3751dd5aedf","event_types":["advisory"],"published_at":"2026-10-25T09:27:35.479231+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:09.75+00:00","detail_url":"/events/34711"}]}},{"id":34914,"cve_ids":["CVE-2026-111909"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API","summary":"phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.","evidence":"cve:CVE-2026-111909","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111909","aliases":["CVE-2026-111909"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:42:56.427Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7j43-ww55-pm3g","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-missing-authorization-allows-superadmin-deletion-via-deleteuser-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111909","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:18:33.662741Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:42:56.427Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:27.466Z"}}},"related_cves":[{"value":"CVE-2026-111909","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:88cc7c0f-021a-43a6-8024-51d8b992503f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111909","advisory_id":"88cc7c0f-021a-43a6-8024-51d8b992503f","event_types":["advisory"],"published_at":"2026-10-25T09:25:29.36174+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:27.466+00:00","detail_url":"/advisories/advisory%3A88cc7c0f-021a-43a6-8024-51d8b992503f","group":{"id":"advisory:88cc7c0f-021a-43a6-8024-51d8b992503f","revision":1,"primary_event_id":34618,"change":"published","superseded_by":[],"changed":{"id":34618,"cve_ids":["CVE-2026-111909"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API","summary":"phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.","evidence":"cve:CVE-2026-111909","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111909","aliases":["CVE-2026-111909"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:42:56.427Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7j43-ww55-pm3g","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-missing-authorization-allows-superadmin-deletion-via-deleteuser-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111909","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:18:33.662741Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:42:56.427Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:27.466Z"}}},"related_cves":[{"value":"CVE-2026-111909","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:88cc7c0f-021a-43a6-8024-51d8b992503f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111909","advisory_id":"88cc7c0f-021a-43a6-8024-51d8b992503f","event_types":["advisory"],"published_at":"2026-10-25T09:25:29.36174+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:27.466+00:00","detail_url":"/events/34618"},"members":[{"id":34618,"cve_ids":["CVE-2026-111909"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API","summary":"phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.","evidence":"cve:CVE-2026-111909","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111909","aliases":["CVE-2026-111909"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:42:56.427Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7j43-ww55-pm3g","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-missing-authorization-allows-superadmin-deletion-via-deleteuser-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111909","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:18:33.662741Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:42:56.427Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:27.466Z"}}},"related_cves":[{"value":"CVE-2026-111909","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:88cc7c0f-021a-43a6-8024-51d8b992503f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111909","advisory_id":"88cc7c0f-021a-43a6-8024-51d8b992503f","event_types":["advisory"],"published_at":"2026-10-25T09:25:29.36174+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:27.466+00:00","detail_url":"/events/34618"}]}},{"id":34874,"cve_ids":["CVE-2026-111904"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve non-public moderation or internal questions and their associated usernames.","evidence":"cve:CVE-2026-111904","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111904","aliases":["CVE-2026-111904"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:19:42.277Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6xm9-p734-8fx6","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-information-disclosure-via-open-questions-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111904","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:19:22.366824Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6xm9-p734-8fx6","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:19:42.277Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:24.116Z"}}},"related_cves":[{"value":"CVE-2026-111904","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7271af06-acd8-4538-b010-1b8ba0c17267","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111904","advisory_id":"7271af06-acd8-4538-b010-1b8ba0c17267","event_types":["advisory"],"published_at":"2026-10-25T09:25:05.674415+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:24.116+00:00","detail_url":"/advisories/advisory%3A7271af06-acd8-4538-b010-1b8ba0c17267","group":{"id":"advisory:7271af06-acd8-4538-b010-1b8ba0c17267","revision":1,"primary_event_id":34580,"change":"published","superseded_by":[],"changed":{"id":34580,"cve_ids":["CVE-2026-111904"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve non-public moderation or internal questions and their associated usernames.","evidence":"cve:CVE-2026-111904","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111904","aliases":["CVE-2026-111904"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:19:42.277Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6xm9-p734-8fx6","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-information-disclosure-via-open-questions-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111904","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:19:22.366824Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6xm9-p734-8fx6","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:19:42.277Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:24.116Z"}}},"related_cves":[{"value":"CVE-2026-111904","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7271af06-acd8-4538-b010-1b8ba0c17267","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111904","advisory_id":"7271af06-acd8-4538-b010-1b8ba0c17267","event_types":["advisory"],"published_at":"2026-10-25T09:25:05.674415+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:24.116+00:00","detail_url":"/events/34580"},"members":[{"id":34580,"cve_ids":["CVE-2026-111904"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve non-public moderation or internal questions and their associated usernames.","evidence":"cve:CVE-2026-111904","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111904","aliases":["CVE-2026-111904"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:19:42.277Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6xm9-p734-8fx6","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-information-disclosure-via-open-questions-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111904","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:19:22.366824Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6xm9-p734-8fx6","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:19:42.277Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:24.116Z"}}},"related_cves":[{"value":"CVE-2026-111904","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7271af06-acd8-4538-b010-1b8ba0c17267","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111904","advisory_id":"7271af06-acd8-4538-b010-1b8ba0c17267","event_types":["advisory"],"published_at":"2026-10-25T09:25:05.674415+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:24.116+00:00","detail_url":"/events/34580"}]}},{"id":34872,"cve_ids":["CVE-2026-111898"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.","evidence":"cve:CVE-2026-111898","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111898","aliases":["CVE-2026-111898"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:21:21.852Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg4w-2j3r-2hhp","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-account-takeover-via-keycloak-implicit-account-linking"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111898","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T11:21:08.495937Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg4w-2j3r-2hhp","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:21:21.852Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:20.655Z"}}},"related_cves":[{"value":"CVE-2026-111898","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b0ce36b7-eacd-400d-aa4b-519b29fdba2a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111898","advisory_id":"b0ce36b7-eacd-400d-aa4b-519b29fdba2a","event_types":["advisory"],"published_at":"2026-10-25T09:25:04.502097+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:20.655+00:00","detail_url":"/advisories/advisory%3Ab0ce36b7-eacd-400d-aa4b-519b29fdba2a","group":{"id":"advisory:b0ce36b7-eacd-400d-aa4b-519b29fdba2a","revision":1,"primary_event_id":34578,"change":"published","superseded_by":[],"changed":{"id":34578,"cve_ids":["CVE-2026-111898"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.","evidence":"cve:CVE-2026-111898","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111898","aliases":["CVE-2026-111898"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:21:21.852Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg4w-2j3r-2hhp","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-account-takeover-via-keycloak-implicit-account-linking"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111898","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T11:21:08.495937Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg4w-2j3r-2hhp","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:21:21.852Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:20.655Z"}}},"related_cves":[{"value":"CVE-2026-111898","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b0ce36b7-eacd-400d-aa4b-519b29fdba2a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111898","advisory_id":"b0ce36b7-eacd-400d-aa4b-519b29fdba2a","event_types":["advisory"],"published_at":"2026-10-25T09:25:04.502097+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:20.655+00:00","detail_url":"/events/34578"},"members":[{"id":34578,"cve_ids":["CVE-2026-111898"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.","evidence":"cve:CVE-2026-111898","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111898","aliases":["CVE-2026-111898"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:21:21.852Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg4w-2j3r-2hhp","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-account-takeover-via-keycloak-implicit-account-linking"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111898","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T11:21:08.495937Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg4w-2j3r-2hhp","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:21:21.852Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:20.655Z"}}},"related_cves":[{"value":"CVE-2026-111898","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b0ce36b7-eacd-400d-aa4b-519b29fdba2a","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111898","advisory_id":"b0ce36b7-eacd-400d-aa4b-519b29fdba2a","event_types":["advisory"],"published_at":"2026-10-25T09:25:04.502097+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:20.655+00:00","detail_url":"/events/34578"}]}},{"id":34871,"cve_ids":["CVE-2026-111893"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.","evidence":"cve:CVE-2026-111893","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111893","aliases":["CVE-2026-111893"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:20:40.712Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gv7w-78f6-mcmh","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-privilege-escalation-via-group-category-restrictions-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111893","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T11:20:37.877447Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gv7w-78f6-mcmh","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:20:40.712Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:17.171Z"}}},"related_cves":[{"value":"CVE-2026-111893","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ac1515d8-dd01-4723-9f75-62921b6d07d5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111893","advisory_id":"ac1515d8-dd01-4723-9f75-62921b6d07d5","event_types":["advisory"],"published_at":"2026-10-25T09:25:03.909617+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:17.171+00:00","detail_url":"/advisories/advisory%3Aac1515d8-dd01-4723-9f75-62921b6d07d5","group":{"id":"advisory:ac1515d8-dd01-4723-9f75-62921b6d07d5","revision":1,"primary_event_id":34577,"change":"published","superseded_by":[],"changed":{"id":34577,"cve_ids":["CVE-2026-111893"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.","evidence":"cve:CVE-2026-111893","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111893","aliases":["CVE-2026-111893"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:20:40.712Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gv7w-78f6-mcmh","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-privilege-escalation-via-group-category-restrictions-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111893","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T11:20:37.877447Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gv7w-78f6-mcmh","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:20:40.712Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:17.171Z"}}},"related_cves":[{"value":"CVE-2026-111893","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ac1515d8-dd01-4723-9f75-62921b6d07d5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111893","advisory_id":"ac1515d8-dd01-4723-9f75-62921b6d07d5","event_types":["advisory"],"published_at":"2026-10-25T09:25:03.909617+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:17.171+00:00","detail_url":"/events/34577"},"members":[{"id":34577,"cve_ids":["CVE-2026-111893"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.","evidence":"cve:CVE-2026-111893","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-111893","aliases":["CVE-2026-111893"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:20:40.712Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gv7w-78f6-mcmh","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-privilege-escalation-via-group-category-restrictions-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111893","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T11:20:37.877447Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gv7w-78f6-mcmh","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:20:40.712Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:17.171Z"}}},"related_cves":[{"value":"CVE-2026-111893","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ac1515d8-dd01-4723-9f75-62921b6d07d5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111893","advisory_id":"ac1515d8-dd01-4723-9f75-62921b6d07d5","event_types":["advisory"],"published_at":"2026-10-25T09:25:03.909617+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:17.171+00:00","detail_url":"/events/34577"}]}},{"id":34870,"cve_ids":["CVE-2026-111888"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API","summary":"phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.","evidence":"cve:CVE-2026-111888","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111888","aliases":["CVE-2026-111888"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:21:59.896Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-incorrect-authorization-via-news-update-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111888","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:21:43.733421Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:21:59.896Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:13.202Z"}}},"related_cves":[{"value":"CVE-2026-111888","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:60d9c144-1a29-41bb-9954-e13c963cb2e0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111888","advisory_id":"60d9c144-1a29-41bb-9954-e13c963cb2e0","event_types":["advisory"],"published_at":"2026-10-25T09:25:03.273658+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:13.202+00:00","detail_url":"/advisories/advisory%3A60d9c144-1a29-41bb-9954-e13c963cb2e0","group":{"id":"advisory:60d9c144-1a29-41bb-9954-e13c963cb2e0","revision":1,"primary_event_id":34576,"change":"published","superseded_by":[],"changed":{"id":34576,"cve_ids":["CVE-2026-111888"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API","summary":"phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.","evidence":"cve:CVE-2026-111888","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111888","aliases":["CVE-2026-111888"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:21:59.896Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-incorrect-authorization-via-news-update-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111888","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:21:43.733421Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:21:59.896Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:13.202Z"}}},"related_cves":[{"value":"CVE-2026-111888","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:60d9c144-1a29-41bb-9954-e13c963cb2e0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111888","advisory_id":"60d9c144-1a29-41bb-9954-e13c963cb2e0","event_types":["advisory"],"published_at":"2026-10-25T09:25:03.273658+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:13.202+00:00","detail_url":"/events/34576"},"members":[{"id":34576,"cve_ids":["CVE-2026-111888"],"payload":{"kind":"advisory","title":"phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API","summary":"phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.","evidence":"cve:CVE-2026-111888","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111888","aliases":["CVE-2026-111888"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T11:21:59.896Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-incorrect-authorization-via-news-update-api"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111888","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:21:43.733421Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T11:21:59.896Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-17T18:46:13.202Z"}}},"related_cves":[{"value":"CVE-2026-111888","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:60d9c144-1a29-41bb-9954-e13c963cb2e0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111888","advisory_id":"60d9c144-1a29-41bb-9954-e13c963cb2e0","event_types":["advisory"],"published_at":"2026-10-25T09:25:03.273658+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-17T18:46:13.202+00:00","detail_url":"/events/34576"}]}},{"id":17469,"cve_ids":["CVE-2026-109573"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint","summary":"phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.","evidence":"cve:CVE-2026-109573","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-109573","aliases":["CVE-2026-109573"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"},{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-13T13:52:56.940Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-sql-injection-via-api-autocomplete-search-endpoint"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109573","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-13T13:52:24.348980Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T13:52:56.940Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:49.354Z"}}},"related_cves":[{"value":"CVE-2026-109573","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4ebd127d-936c-4799-9f3d-ced5646b22a5","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109573","advisory_id":"4ebd127d-936c-4799-9f3d-ced5646b22a5","event_types":["advisory"],"published_at":"2026-10-25T01:31:34.304871+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:49.354+00:00","detail_url":"/advisories/advisory%3A4ebd127d-936c-4799-9f3d-ced5646b22a5","group":{"id":"advisory:4ebd127d-936c-4799-9f3d-ced5646b22a5","revision":1,"primary_event_id":17354,"change":"published","superseded_by":[],"changed":{"id":17354,"cve_ids":["CVE-2026-109573"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint","summary":"phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.","evidence":"cve:CVE-2026-109573","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-109573","aliases":["CVE-2026-109573"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"},{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-13T13:52:56.940Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-sql-injection-via-api-autocomplete-search-endpoint"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109573","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-13T13:52:24.348980Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T13:52:56.940Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:49.354Z"}}},"related_cves":[{"value":"CVE-2026-109573","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4ebd127d-936c-4799-9f3d-ced5646b22a5","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109573","advisory_id":"4ebd127d-936c-4799-9f3d-ced5646b22a5","event_types":["advisory"],"published_at":"2026-10-25T01:31:34.304871+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:49.354+00:00","detail_url":"/events/17354"},"members":[{"id":17354,"cve_ids":["CVE-2026-109573"],"payload":{"kind":"advisory","title":"phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint","summary":"phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.","evidence":"cve:CVE-2026-109573","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-109573","aliases":["CVE-2026-109573"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"0","lessThan":"4.1.9","versionType":"semver"},{"status":"unaffected","version":"4.1.9","versionType":"semver"},{"status":"affected","version":"4.2.0-alpha","lessThan":"4.2.0-beta","versionType":"semver"},{"status":"unaffected","version":"4.2.0-beta","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-13T13:52:56.940Z","provider":"cve","references":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-sql-injection-via-api-autocomplete-search-endpoint"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109573","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-13T13:52:24.348980Z"}}}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T13:52:56.940Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:49.354Z"}}},"related_cves":[{"value":"CVE-2026-109573","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4ebd127d-936c-4799-9f3d-ced5646b22a5","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109573","advisory_id":"4ebd127d-936c-4799-9f3d-ced5646b22a5","event_types":["advisory"],"published_at":"2026-10-25T01:31:34.304871+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:49.354+00:00","detail_url":"/events/17354"}]}},{"id":17462,"cve_ids":["CVE-2026-108851"],"payload":{"kind":"advisory","title":"phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool","summary":"phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.","evidence":"cve:CVE-2026-108851","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108851","aliases":["CVE-2026-108851"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":4.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/thorsten/phpMyFAQ","vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.1.0","versionType":"semver","lessThanOrEqual":"4.1.10"}],"packageURL":"pkg:composer/thorsten/phpmyfaq","defaultStatus":"unaffected"}],"modified":"2026-10-13T13:39:25.428Z","provider":"cve","references":["https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/phpmyfaq-mcp-search-visibility","https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Search.php#L137-L194","https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Service/McpServer/FaqSearchToolExecutor.php#L56-L102","https://github.com/thorsten/phpMyFAQ","https://www.vulncheck.com/advisories/phpmyfaq-through-4.1.10-missing-authorization-via-mcp-server-faq-search-tool"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108851","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T13:38:33.346482Z"}}}],"references":[{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/phpmyfaq-mcp-search-visibility","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T13:39:25.428Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-11T13:26:01.436Z"}}},"related_cves":[{"value":"CVE-2026-108851","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:46039dab-9e5b-429c-ab8b-773af836a9e9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108851","advisory_id":"46039dab-9e5b-429c-ab8b-773af836a9e9","event_types":["advisory"],"published_at":"2026-10-25T01:31:30.109545+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-11T13:26:01.436+00:00","detail_url":"/advisories/advisory%3A46039dab-9e5b-429c-ab8b-773af836a9e9","group":{"id":"advisory:46039dab-9e5b-429c-ab8b-773af836a9e9","revision":1,"primary_event_id":17347,"change":"published","superseded_by":[],"changed":{"id":17347,"cve_ids":["CVE-2026-108851"],"payload":{"kind":"advisory","title":"phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool","summary":"phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.","evidence":"cve:CVE-2026-108851","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108851","aliases":["CVE-2026-108851"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":4.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/thorsten/phpMyFAQ","vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.1.0","versionType":"semver","lessThanOrEqual":"4.1.10"}],"packageURL":"pkg:composer/thorsten/phpmyfaq","defaultStatus":"unaffected"}],"modified":"2026-10-13T13:39:25.428Z","provider":"cve","references":["https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/phpmyfaq-mcp-search-visibility","https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Search.php#L137-L194","https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Service/McpServer/FaqSearchToolExecutor.php#L56-L102","https://github.com/thorsten/phpMyFAQ","https://www.vulncheck.com/advisories/phpmyfaq-through-4.1.10-missing-authorization-via-mcp-server-faq-search-tool"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108851","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T13:38:33.346482Z"}}}],"references":[{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/phpmyfaq-mcp-search-visibility","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T13:39:25.428Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-11T13:26:01.436Z"}}},"related_cves":[{"value":"CVE-2026-108851","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:46039dab-9e5b-429c-ab8b-773af836a9e9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108851","advisory_id":"46039dab-9e5b-429c-ab8b-773af836a9e9","event_types":["advisory"],"published_at":"2026-10-25T01:31:30.109545+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-11T13:26:01.436+00:00","detail_url":"/events/17347"},"members":[{"id":17347,"cve_ids":["CVE-2026-108851"],"payload":{"kind":"advisory","title":"phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool","summary":"phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.","evidence":"cve:CVE-2026-108851","products":[{"name":{"value":"phpMyFAQ","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108851","aliases":["CVE-2026-108851"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":4.8,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/thorsten/phpMyFAQ","vendor":"thorsten","product":"phpMyFAQ","versions":[{"status":"affected","version":"4.1.0","versionType":"semver","lessThanOrEqual":"4.1.10"}],"packageURL":"pkg:composer/thorsten/phpmyfaq","defaultStatus":"unaffected"}],"modified":"2026-10-13T13:39:25.428Z","provider":"cve","references":["https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/phpmyfaq-mcp-search-visibility","https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Search.php#L137-L194","https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Service/McpServer/FaqSearchToolExecutor.php#L56-L102","https://github.com/thorsten/phpMyFAQ","https://www.vulncheck.com/advisories/phpmyfaq-through-4.1.10-missing-authorization-via-mcp-server-faq-search-tool"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108851","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T13:38:33.346482Z"}}}],"references":[{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/phpmyfaq-mcp-search-visibility","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T13:39:25.428Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-11T13:26:01.436Z"}}},"related_cves":[{"value":"CVE-2026-108851","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:46039dab-9e5b-429c-ab8b-773af836a9e9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108851","advisory_id":"46039dab-9e5b-429c-ab8b-773af836a9e9","event_types":["advisory"],"published_at":"2026-10-25T01:31:30.109545+00:00","technologies":["core-cve","phpmyfaq"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-11T13:26:01.436+00:00","detail_url":"/events/17347"}]}}],"next_after":50464,"next_before":17462}