CVE Alert: CVE-2026-116183 – thorsten

phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.

**Risk verdict:** High-priority integrity risk for exposed instances; urgency is elevated, but active exploitation cannot be confirmed because KEV and SSVC status are not provided.

**Why this matters:** An attacker could corrupt public-submission workflows and create misleading records that staff may treat as legitimate. Deleting submissions, where that option is enabled, could also disrupt triage and remove useful evidence; the likely impact is data integrity and operational trust rather than system-wide compromise.

**Most likely attack path:** An unauthenticated attacker reaches the public API over the network and submits a crafted request; the low-complexity, no-interaction preconditions make this practical to automate. The described CAPTCHA requirement may slow abuse, but does not provide authorisation. Scope is unchanged, so direct lateral movement is not indicated; risk to connected systems depends on how staff consume or process altered records.

**Who is most exposed:** Internet-accessible deployments that accept visitor questions are most exposed, especially where deletion is enabled or submissions feed staff workflows.

Alert on unusual requests to the question-creation API, especially repeated or mismatched question identifiers.

Review audit/history records for unexpected category changes or forged answer-state entries.

Look for bursts of CAPTCHA completions followed by anomalous modifications or deletions.

Check web and application logs for unauthenticated requests preceding question changes.

Mitigation and prioritisation:

Upgrade to the fixed release or later; prioritise internet-facing instances.

Until upgraded, restrict API access where feasible and disable question deletion if operationally safe.

Validate ownership server-side for every submitted question identifier.

Preserve relevant logs and review affected records; test changes before deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.