{"schema":"threatline.record/2","record":{"id":"GHSA-cmvh-fpmf-8gfx","aliases":["GHSA-cmvh-fpmf-8gfx"],"summary":"CSRF Allows Unauthorized Elasticsearch/OpenSearch Index Operations","details":"## Summary\r\n\r\nThe Elasticsearch and OpenSearch administration API endpoints do not enforce CSRF protection for destructive and state-changing operations.\r\n\r\nAffected actions include:\r\n\r\n* `POST /admin/api/elasticsearch/create`\r\n* `POST /admin/api/elasticsearch/drop`\r\n* `POST /admin/api/elasticsearch/import`\r\n* Corresponding OpenSearch endpoints\r\n\r\nThe endpoints only require the global `CONFIGURATION_EDIT` permission and do not validate a CSRF token.\r\n\r\n## Reproduction\r\n\r\nTested on phpMyFAQ `4.1.8`.\r\n\r\nAn authenticated user with only `CONFIGURATION_EDIT` permission sent the following request without a CSRF token:\r\n\r\n```http\r\nPOST /admin/api/elasticsearch/drop HTTP/1.1\r\nHost: localhost:8080\r\nCookie: PHPSESSID=<u_conf-session>\r\nContent-Type: application/json\r\n\r\n{}\r\n```\r\n\r\nThe request passed the endpoint authorization checks and reached the Elasticsearch service initialization.\r\n\r\nThe test environment returned:\r\n\r\n```text\r\nFatal error: Undefined constant PMF_ELASTICSEARCH_TOKENIZER\r\n```\r\n\r\nbecause Elasticsearch was disabled/misconfigured in the test environment.\r\n\r\nThis confirms that the request reached the Elasticsearch operation without CSRF validation. In an environment with the service correctly configured, the requested operation would proceed to the corresponding Elasticsearch action.\r\n\r\n## Root Cause\r\n\r\nNeither `ElasticsearchController` nor `OpenSearchController` performs `Token::verifyToken()` validation for the `create()`, `drop()`, or `import()` actions.\r\n\r\n## Impact\r\n\r\nA malicious website may trigger these state-changing operations through the authenticated browser of a user with `CONFIGURATION_EDIT` permission.\r\n\r\nDepending on the enabled backend and operation, this may allow:\r\n\r\n* deletion of the search index;\r\n* forced full FAQ re-indexing;\r\n* resource exhaustion during large imports/re-indexing;\r\n* disruption of search functionality.\r\n\r\n## Remediation\r\n\r\nRequire a valid page-scoped CSRF token for all state-changing actions in both controllers:\r\n\r\n* `create()`\r\n* `drop()`\r\n* `import()`\r\n\r\nThe CSRF check should occur before invoking the Elasticsearch/OpenSearch service.\r\n","categories":["Unclassified"],"product":"thorsten/phpmyfaq","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-cmvh-fpmf-8gfx","source_modified_at":"2026-10-03T11:36:55Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"composer","name":"thorsten/phpmyfaq"},"range":"4.1.8"}],"fixed_versions":[],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-03T11:36:55Z","modified_at":"2026-10-03T11:36:55Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-cmvh-fpmf-8gfx","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-03T11:36:55Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-03T11:36:55Z","content_hash":"41922d4a99726a32359fc13a2645852c3eaba143e9a421731fe9c7df06cfb4f9"}}