Is CVE-2026-111888 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111888?

CVE-2026-111888 has a CVSS v3 severity of LOW (2.7).

Back

CVE-2026-111888

Description

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.