Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-111907— phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database

Quick assessment

Affected

thorsten phpMyFAQ

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

phpMyFAQ 4.0.0 至 4.1.9 之前的版本中，POST /admin/api/update-database 接口存在跨站请求伪造（CSRF）漏洞。该接口在执行数据库迁移时未验证 CSRF 令牌。攻击者可诱导拥有 CONFIGURATION_EDIT 权限的已登录用户提交精心构造的跨站请求，从而触发可能影响数据库完整性或可用性的迁移操作。

CVSS 7.1 · High Updated Oct 18, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
thorsten	phpMyFAQ	`4.0.0< 4.1.9`	affected
		`4.1.9`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database

Source: CVE Program / CVE List V5

Vulnerability Description

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨站请求伪造(CSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
thorsten	phpMyFAQ	4.0.0 ~ 4.1.9	-

II. Public POCs for CVE-2026-111907

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111907

请登录查看更多情报信息。

Other References for CVE-2026-111907 (2)

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6x9g-rfx8-g42q vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-csrf-via-admin-api-update-database third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-111907

Same Patch Batch · thorsten · 2026-10-17 · 28 CVEs total

CVE-2026-111911	9.8 CRITICAL	phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
CVE-2026-111908	8.3 HIGH	phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST
CVE-2026-111884	8.3 HIGH	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up o
CVE-2026-111909	8.1 HIGH	phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API
CVE-2026-111882	8.1 HIGH	phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SS
CVE-2026-111901	7.5 HIGH	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
CVE-2026-111898	7.5 HIGH	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Link
CVE-2026-111897	7.1 HIGH	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration E
CVE-2026-111895	6.8 MEDIUM	phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID pref
CVE-2026-111910	6.5 MEDIUM	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachmen
CVE-2026-111886	6.5 MEDIUM	phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint
CVE-2026-111892	6.5 MEDIUM	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints
CVE-2026-111893	6.5 MEDIUM	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restriction
CVE-2026-111906	6.5 MEDIUM	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch A
CVE-2026-111905	6.0 MEDIUM	phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /
CVE-2026-111891	5.5 MEDIUM	phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions A
CVE-2026-111890	5.5 MEDIUM	phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights
CVE-2026-111885	5.5 MEDIUM	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API
CVE-2026-111896	5.4 MEDIUM	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass
CVE-2026-111894	5.4 MEDIUM	phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data:

Showing top 20 of 28 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: phpMyFAQ

Same vendor: thorsten

Same weakness: CWE-352

V. Comments for CVE-2026-111907

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-111907— phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 2

I. Basic Information for CVE-2026-111907

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-111907

III. Intelligence Information for CVE-2026-111907

Other References for CVE-2026-111907 (2)

Same Patch Batch · thorsten · 2026-10-17 · 28 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-111907

Leave a comment