EUVD-2026-103312

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global editfaq permission and does not verify access to the target FAQ. Authenticated users with editfaq...

CVE-2026-111908

The phpMyFAQ software (versions 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta ) is vulnerable to a broken object-level authorization (BOLA) flaw in the PUT /api/v3.1/faq/update endpoint. The root cause is that the application verifies the global edit_faq permission but fails to validate if...