EUVD-2026-103333

phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to...

EUVD-2026-103334

phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUPDELETE can send a crafted groupId to /admin/api/group/delete to...

CVE-2026-111886

The phpMyFAQ application (versions 4.2.0-alpha.2 before 4.2.0-beta ) is vulnerable to a 2FA brute-force attack due to a lack of lockout mechanisms in the removeTwofactorConfig() endpoint. An authenticated attacker possessing a hijacked session and CSRF token can perform unlimited POST requests to...

EUVD-2026-103335

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111884

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111884

The phpMyFAQ application versions prior to 4.1.9 and 4.2.0-alpha (before 4.2.0-beta ) are vulnerable to an account takeover flaw. The software fails to require the current password when a user updates their account email via the user control panel (specifically UserController::updateData and api/...

CVE-2026-111882 phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

CVE-2026-111882 phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

CVE-2026-111882

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

EUVD-2026-103336

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

CVE-2026-111882

The phpMyFAQ application versions 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta are vulnerable to an authentication bypass (CWE-287). The root cause lies in the Keycloak and Entra ID SSO callbacks, which allow IdP-authenticated users to skip TOTP two-factor authentication . An attack...

PT-2026-116454

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.0-alpha through 4.1.8 phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha Description An authentication bypass exists that allows users authenticated via an Identity Provider IdP to skip Time-based One-Time Password TOTP...

PT-2026-116457

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.2.0-alpha.2 through 4.2.0-beta Description The software lacks a brute-force lockout mechanism in the removeTwofactorConfig function. This allows authenticated attackers who possess a hijacked session and a CSRF token to...

CVE-2026-111909: Improper Privilege Management

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1...

CVE-2026-111906: Cross-Site Request Forgery (CSRF)

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATIONED...

CVE-2026-111901: Uncontrolled Resource Consumption

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the...

CVE-2026-111905: Authorization Bypass Through User-Controlled Key

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...

CVE-2026-111895: Improper Authentication

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...