CVE-2026-111888

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.0.0 through 4.1.8

Description An incorrect authorization issue exists where delegated administrators without the editnews permission can modify news items. This occurs because the endpoint "PUT /admin/api/news/update" incorrectly verifies the NEWS DELETE permission instead of NEWS EDIT. Users possessing addnews and delnews permissions can retrieve the update-news CSRF token from their cookies to alter the header, body, author, link, and active status of any news item displayed on the public front page.

Recommendations Update phpMyFAQ to version 4.1.9 or later.