CVE-2026-111905 thorsten CVE debrief

Who should care

phpMyFAQ administrators, users with delegated administration rights, and security teams responsible for monitoring and protecting FAQ management systems should assess their exposure and take necessary actions to prevent exploitation.

Why it matters

CVE-2026-111905 is a high-severity vulnerability in phpMyFAQ that allows delegated administrators to read TOTP secrets and bypass two-factor authentication. phpMyFAQ administrators and users should prioritize verifying their systems' exposure and applying patches or mitigations.

• Delegated administrators can read SuperAdmin TOTP secrets
• Valid TOTP codes can be generated to bypass two-factor authentication
• Exposure requires verification from official sources
• Remediation priority is high due to potential for authentication bypass

Technical summary

The vulnerability is caused by an insecure direct object reference (IDOR) in the GET /admin/api/user/data/{userId} endpoint of phpMyFAQ. This allows delegated administrators with user-management rights to read the TOTP secret of any user, including SuperAdmins, without proper authorization checks. Affected product deployments should be verified for exposure, and patches or mitigations should be applied according to vendor guidance. Compensating controls and monitoring may be necessary for exposed systems while remediation is scheduled.

Defensive priority

phpMyFAQ administrators and users should prioritize verifying their systems' exposure and applying patches or mitigations.

Recommended defensive actions

• Verify phpMyFAQ version and check for exposure
• Apply patches or mitigations if available
• Monitor for suspicious activity related to the /admin/api/user/data endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. However, the corpus does not provide information on exploitation or affected versions beyond phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.