CVE-2026-111888

The phpMyFAQ software (versions 4.0.0 before 4.1.9 ) is vulnerable to an incorrect authorization flaw in the news update API. The root cause is that the PUT /admin/api/news/update endpoint incorrectly validates the NEWS_DELETE permission instead of the required NEWS_EDIT right. Consequently, dele...