CVE-2026-49205
Description
phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed this in the BackupController by adding: $this->userHasPermission(PermissionType::BACKUP). The same fix was not applied to 4 other write endpoints in the public API. All 4 only call $this->hasValidToken() — which checks a shared API key header, rather than the individual user's role permissions. The following APIs are affected: POST /api/v4.0/category (CategoryController::create), POST /api/v4.0/faq (FaqController::create), PUT /api/v4.0/faq (FaqController::update), and POST /api/v4.0/question (QuestionController::create). This issue has been fixed in version 4.1.4.
How to fix
- thorsten/phpmyfaq4.1.4 or later
- phpmyfaq/phpmyfaq4.1.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thorsten/phpmyfaqPackagist | v < 4.1.4 | 4.1.4 |
| phpmyfaq/phpmyfaqPackagist | v < 4.1.4 | 4.1.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.