CVE-2026-111888 thorsten CVE debrief

Who should care

Defenders responsible for phpMyFAQ installations, security teams assessing vulnerability impact, and administrators of systems using phpMyFAQ should be aware of this vulnerability and take necessary actions to verify exposure and mitigate potential risks.

Why it matters

CVE-2026-111888 is a medium-severity vulnerability affecting phpMyFAQ versions from 4.0.0 before 4.1.9, allowing delegated admins lacking the editnews right to modify news. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems.

• Verification of phpMyFAQ installations for exposure to this vulnerability is necessary to prevent potential unauthorized modifications.
• Assessment of the impact of this vulnerability on phpMyFAQ systems is crucial to determine the extent of potential risks.
• Updating phpMyFAQ to version 4.1.9 or later is recommended to address this vulnerability.

Technical summary

The vulnerability allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page. This issue affects phpMyFAQ versions from 4.0.0 before 4.1.9, and defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems.

Defensive priority

Defenders should prioritize verifying exposure of phpMyFAQ installations and assessing the impact of this vulnerability on their systems.

Recommended defensive actions

• Verify phpMyFAQ installations for exposure to this vulnerability
• Assess the impact of this vulnerability on phpMyFAQ systems
• Update phpMyFAQ to version 4.1.9 or later if possible
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but do not offer specific information on exploitation or affected versions beyond the mentioned range. Defenders should verify phpMyFAQ installations for exposure, assess potential impact, and review official advisories for guidance. Limited source detail exists on actual exploitation or specific affected deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.