{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "thorsten phpmyfaq: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/thorsten--phpmyfaq/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/thorsten--phpmyfaq/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-116183/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-116183/",
   "title": "CVE-2026-116183 · thorsten phpmyfaq · disclosed",
   "content_text": "phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.",
   "date_published": "2026-10-25T13:20:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111911/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111911/",
   "title": "CVE-2026-111911 · thorsten phpmyfaq · disclosed",
   "content_text": "phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.",
   "date_published": "2026-10-17T18:46:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111909/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111909/",
   "title": "CVE-2026-111909 · thorsten phpmyfaq · disclosed",
   "content_text": "phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.",
   "date_published": "2026-10-17T18:46:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111908/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111908/",
   "title": "CVE-2026-111908 · thorsten phpmyfaq · disclosed",
   "content_text": "phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.",
   "date_published": "2026-10-17T18:46:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111907/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111907/",
   "title": "CVE-2026-111907 · thorsten phpmyfaq · disclosed",
   "content_text": "phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.",
   "date_published": "2026-10-17T18:46:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111901/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111901/",
   "title": "CVE-2026-111901 · thorsten phpmyfaq · disclosed",
   "content_text": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.",
   "date_published": "2026-10-17T18:46:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111898/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111898/",
   "title": "CVE-2026-111898 · thorsten phpmyfaq · disclosed",
   "content_text": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.",
   "date_published": "2026-10-17T18:46:20Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111897/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111897/",
   "title": "CVE-2026-111897 · thorsten phpmyfaq · disclosed",
   "content_text": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.",
   "date_published": "2026-10-17T18:46:19Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111884/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111884/",
   "title": "CVE-2026-111884 · thorsten phpmyfaq · disclosed",
   "content_text": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.",
   "date_published": "2026-10-17T18:46:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111882/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111882/",
   "title": "CVE-2026-111882 · thorsten phpmyfaq · disclosed",
   "content_text": "phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.",
   "date_published": "2026-10-17T18:46:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109573/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109573/",
   "title": "CVE-2026-109573 · thorsten phpmyfaq · disclosed",
   "content_text": "phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.",
   "date_published": "2026-10-12T22:21:49Z"
  }
 ]
}