Santhoshinipayload

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.4 **Description** Missing authorization in the public API allows users to bypass role permission checks. The system only verifies a shared API key header via the `hasValidToken()` function instead of validating individual user permissions. This affects the following endpoints: - "POST /api/v4.0/category" (CategoryController::create) - "POST /api/v4.0/faq" (FaqController::create) - "PUT /api/v4.0/faq" (FaqController::update) - "POST /api/v4.0/question" (QuestionController::create) **Recommendations** Update to version 4.1.4.