CVE-2026-111889

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.1.0 through 4.1.8 phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha

Description An authorization flaw in the admin dashboard allows authenticated users who lack administrative privileges to access restricted information. By requesting the '/admin/index.php/' endpoint, an attacker with any active account can view unpublished FAQ questions, administrative edit URLs, recent user identities, and site statistics.

Recommendations Update phpMyFAQ versions 4.1.0 through 4.1.8 to version 4.1.9. Update phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha to version 4.2.0-beta.