Is CVE-2026-116183 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116183?

CVE-2026-116183 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-116183

Description

phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.