CVE-2026-111884

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.9 phpMyFAQ versions 4.2.0-alpha through 4.2.0-beta

Description The user control panel fails to require the current password when updating an account email. The system only verifies the session and CSRF token. An attacker who has hijacked a session can change the email address to one they control and then utilize the password-reset process to take over accounts that do not have two-factor authentication (2FA) enabled, including superadmin accounts. This issue occurs within the updateData() function and the 'api/user/data/update' endpoint.

Recommendations Update phpMyFAQ to version 4.1.9 or later. Update phpMyFAQ to version 4.2.0-beta or later.