CVE-2026-111888

Publié : 17 octobre 2026

Modifié : 17 octobre 2026

Score CVSS

2.7

LOW

Description détaillée

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Références et Patchs

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7 https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-incorrect-authorization-via-news-update-api

Dernières Vulnérabilités

CVE-2026-108117

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-107772

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-107345

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS