PhpMyFAQ: 25 Vulnerabilities Including Critical Auth Bypass Disclosed Together
A batch of 25 vulnerabilities, including a Critical authentication bypass, were disclosed for PhpMyFAQ, affecting versions prior to 4.1.9 and 4.2.0-beta.
Key findings
- Critical authentication bypass via WebAuthn registration in PhpMyFAQ (CVE-2026-111911).
- Multiple privilege escalation flaws allow unauthorized administrative access.
- Stored XSS vulnerabilities enable script execution through SVG and iframes.
- CSRF vulnerabilities affect critical administrative functions like database migrations.
- Patches available in PhpMyFAQ versions 4.1.9 and 4.2.0-beta.
- 25 vulnerabilities disclosed on the same day, impacting various security aspects.
On October 17, 2026, a significant batch of 25 vulnerabilities was disclosed for PhpMyFAQ, a popular open-source web-based FAQ management system. These vulnerabilities, disclosed on the same day, span a range of severities from Low to Critical, with the most severe being an authentication bypass flaw. The disclosures highlight critical security weaknesses across various aspects of the software, including authentication, authorization, and data handling.
Several vulnerabilities revolve around authentication and authorization bypass. CVE-2026-111911, a Critical severity vulnerability, allows attackers to bypass authentication by exploiting a weakness in WebAuthn registration endpoints, enabling them to register a passkey to any account without proper validation. Similarly, CVE-2026-111910 and CVE-2026-111900 detail authorization bypasses in attachment handling, allowing unauthorized access to attachments. CVE-2026-111903, CVE-2026-111896, and CVE-2026-111894 highlight stored cross-site scripting (XSS) vulnerabilities, where attackers can inject malicious scripts through SVG uploads or iframes, potentially leading to script execution within the application.
Privilege escalation is another major theme within this batch. CVE-2026-111909 describes a vulnerability in the deleteUser() API that allows authenticated non-superadmin users to delete superadmin accounts. CVE-2026-111893 and CVE-2026-111891 detail privilege escalation flaws in group and permission management, allowing delegated administrators to gain broader access than intended. CVE-2026-111890 further exacerbates this by allowing administrators to grant unrestricted group rights by dropping per-right language restrictions.
Cross-Site Request Forgery (CSRF) vulnerabilities are also present, with CVE-2026-111907 and CVE-2026-111906 allowing attackers to trick logged-in users into performing unintended actions, such as database migrations or Elasticsearch/OpenSearch administration tasks, without proper CSRF token validation.
Other notable vulnerabilities include an information disclosure flaw (CVE-2026-111904) allowing unauthenticated attackers to read hidden open questions, an account enumeration vulnerability (CVE-2026-111887) that confirms registered display names and emails, and an uncontrolled resource consumption vulnerability (CVE-2026-111901) that can lead to server crashes through concurrent GET requests.
The affected versions for most of these vulnerabilities are phpMyFAQ versions before 4.1.9 and 4.2.0-beta. The vendor has released patches, with versions 4.1.9 and 4.2.0-beta addressing these issues. Users are strongly advised to update to the latest patched versions to mitigate these widespread security risks.
This extensive batch of vulnerabilities underscores the importance of regular security audits and timely patching for web applications like PhpMyFAQ. The variety of attack vectors, from authentication bypass to privilege escalation and XSS, presents a significant risk to organizations relying on this software. Promptly applying the available updates is crucial to protect against potential exploitation.
Key findings from this disclosure include:
- A Critical authentication bypass vulnerability (CVE-2026-111911) in WebAuthn registration.
- Multiple privilege escalation flaws allowing unauthorized administrative access.
- Stored XSS vulnerabilities enabling script execution via SVG uploads and iframes.
- CSRF vulnerabilities impacting database migrations and search administration.
- A wide range of affected versions, with patches available in 4.1.9 and 4.2.0-beta.
- Critical and High severity vulnerabilities present, demanding immediate attention.
The disclosed vulnerabilities are CVE-2026-111911, CVE-2026-111910, CVE-2026-111909, CVE-2026-111908, CVE-2026-111907, CVE-2026-111906, CVE-2026-111905, CVE-2026-111904, CVE-2026-111903, CVE-2026-111902, CVE-2026-111901, CVE-2026-111900, CVE-2026-111898, CVE-2026-111897, CVE-2026-111896, CVE-2026-111895, CVE-2026-111894, CVE-2026-111893, CVE-2026-111892, CVE-2026-111891, CVE-2026-111890, CVE-2026-111889, CVE-2026-111888, CVE-2026-111887, CVE-2026-111886.