CVE-2026-111906

phpMyFAQ versions prior to 4.1.9 and 4.2.0-alpha before 4.2.0-beta are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. The flaw exists in the Elasticsearch and OpenSearch administration API endpoints because they fail to validate CSRF tokens for create , drop , and import actions...