CVE-2026-111907

7.1High

Published 17 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: High impact on availability
Weakness: CWE-352

Impact

Attackers can trigger unauthorized database migrations to corrupt data or cause a denial of service. Exploitation requires tricking an authenticated user with CONFIGURATION_EDIT permissions into submitting a cross-site request.

Root cause

The POST /admin/api/update-database endpoint executes database migrations without validating CSRF tokens.

Affected systems

phpMyFAQ 4.0.0 before 4.1.9

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Fix & remediation

Upgrade phpMyFAQ to version 4.1.9 or later. If upgrading must wait, restrict access to the /admin/api/update-database endpoint at your reverse proxy or web server.

shell

$ composer update phpmyfaq/phpmyfaq --with-dependencies

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111907