All vulnerabilities
CVE-2026-111905GHSA-hp8j-w94m-j5c7

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data

thorsten phpMyFAQ
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 21 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.1.9Also 4.2.0-betaCVE List
Published17 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 4.1.9phpMyFAQCVE List
  • 4.2.0-betaphpMyFAQCVE List
  • 4.1.9phpmyfaq/phpmyfaq, composerGitHubcomposer require "phpmyfaq/phpmyfaq:^4.1.9"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.

Text from CVE List

Affected versions 5

  • phpMyFAQaffected: 3.2.0 before 4.1.9CVE List
  • phpMyFAQunaffected: 4.1.9CVE List
  • phpMyFAQaffected: 4.2.0-alpha before 4.2.0-betaCVE List
  • phpMyFAQunaffected: 4.2.0-betaCVE List
  • phpmyfaq/phpmyfaq, composer<= 4.1.8GitHub

References 2