CVE-2026-111884

High

Description

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.

SeverityHigh

CVSS8.3

Exploit probability—

ProductphpMyFAQ

PublishedOct 17, 2026

First seenOct 17, 2026

Weakness typeCWE-308CWE-308

How to fix

Update

thorsten phpMyFAQ4.1.9, 4.2.0-beta or later

Vendor advisories

github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7554-gx6g-xx77

Affected products

Product	Affected versions	Fixed in
thorsten phpMyFAQ	v < 4.1.9, 4.2.0-alpha ≤ v < 4.2.0-beta	4.1.9, 4.2.0-beta

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.