Vulnerabilities

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET…

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

6.0

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-111905 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 14d ago

   phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to…

   CVSS 6.5 CVE-2026-111910
2. 10
   CVE NVD 14d ago

   phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT…

   CVSS 8.3 CVE-2026-111908
3. 8
   CVE NVD 14d ago

   phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch…

   CVSS 6.5 CVE-2026-111906 Elastic OpenSearch
4. 3
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open…

   CVSS 5.3 CVE-2026-111904
5. 3
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ…

   CVSS 5.3 CVE-2026-111902
6. 10
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API…

   CVSS 7.5 CVE-2026-111901
7. 3
   CVE NVD 14d ago

   phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify…

   CVSS 4.3 CVE-2026-111900
8. 22
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by…

   CVSS 7.5 CVE-2026-111898 Red Hat
9. 10
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments…

   CVSS 7.1 CVE-2026-111897
10. 21
    CVE NVD 14d ago

    phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by…

    CVSS 6.8 CVE-2026-111895 Microsoft
11. 8
    CVE NVD 14d ago

    phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content…

    CVSS 5.4 CVE-2026-111894 Oracle
12. 3
    CVE NVD 14d ago

    phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets…

    CVSS 6.5 CVE-2026-111893
13. 3
    CVE NVD 14d ago

    phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and…

    CVSS 5.5 CVE-2026-111891
14. 3
    CVE NVD 14d ago

    phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right…

    CVSS 5.5 CVE-2026-111890
15. 3
    CVE NVD 14d ago

    phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows…

    CVSS 4.3 CVE-2026-111889
16. 3
    CVE NVD 14d ago

    phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to…

    CVSS 5.3 CVE-2026-111887
17. 3
    CVE NVD 14d ago

    phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits…

    CVSS 5.5 CVE-2026-111885
18. 10
    CVE NVD 14d ago

    phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control…

    CVSS 8.3 CVE-2026-111884
19. 28
    CVE NVD 14d ago

    phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated…

    CVSS 8.1 CVE-2026-111882 Microsoft Red Hat