EUVD-2026-103314

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATIONED...

CVE-2026-111906 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATIONED...

CVE-2026-111906

phpMyFAQ versions prior to 4.1.9 and 4.2.0-alpha before 4.2.0-beta are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. The flaw exists in the Elasticsearch and OpenSearch administration API endpoints because they fail to validate CSRF tokens for create , drop , and import actions...

CVE-2026-111906 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATIONED...

CVE-2026-111905 phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...

CVE-2026-111904 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions...

EUVD-2026-103316

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions...

CVE-2026-111904 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions...

CVE-2026-111904

phpMyFAQ versions 4.2.0-alpha before 4.2.0-beta are vulnerable to an information disclosure vulnerability. The root cause is an inverted api.onlyPublicQuestions check within the OpenQuestionController . This flaw allows unauthenticated attackers to send GET requests to the /api/v4.0/open-question...

CVE-2026-111904 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions...

CVE-2026-111905 phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...

EUVD-2026-103315

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...

CVE-2026-111905

The software phpMyFAQ versions 3.2.0 (before 4.1.9) and 4.2.0-alpha (before 4.2.0-beta) is vulnerable to an Insecure Direct Object Reference (IDOR) in the GET /admin/api/user/data/{userId} endpoint. The root cause is the lack of a SuperAdmin or protected-target check, allowing the API to return t...

CVE-2026-111903 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQEDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href,...

EUVD-2026-103317

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQEDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href,...

CVE-2026-111903 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQEDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href,...

CVE-2026-111903

The software phpMyFAQ (versions 4.2.0-alpha before 4.2.0-beta ) is vulnerable to a stored cross-site scripting (XSS) flaw in the SvgSanitizer component. This vulnerability allows users with FAQ_EDIT permissions to bypass input sanitization by utilizing XML DTD custom entities . An attacker can up...

CVE-2026-111902

The phpMyFAQ software (versions 4.2.0-alpha before 4.2.0-beta ) is vulnerable to an authorization bypass in the isFaqAccessibleForUser() function. The root cause is that the system incorrectly treats missing FAQ translations as visible to unauthenticated users. By sending a mismatched Accept-Lang...

CVE-2026-111902 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read...

EUVD-2026-103318

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read...