phpMyFAQ CVE-2026-111906

Exploitation requires a victim who is both currently authenticated to phpMyFAQ and holds the CONFIGURATION_EDIT permission, and who is successfully lured to an attacker-controlled page while that session is active (UI:P). The vulnerable surface is specifically the Elasticsearch and OpenSearch administration API endpoints for the create, drop, and import index actions, which omit CSRF token validation. Limiting factors: the attack cannot succeed against unauthenticated or low-privilege users, depends on social-engineering a specific privileged administrator, and only affects instances that have the Elasticsearch/OpenSearch search integration configured and in use. Versions at or above 4.1.9 (or 4.2.0-beta for the alpha branch) are not affected.

This is a CWE-352 cross-site request forgery flaw with a moderate CVSS 4.0 base score of 7.1. The provided vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) tells a coherent story: the attacker needs no privileges of their own (PR:N) and no special attack requirements, but the attack hinges on passive user interaction (UI:P) - a logged-in victim holding CONFIGURATION_EDIT permission must be lured to a malicious page. The impact is availability-only (VA:H), with no confidentiality or integrity loss (VC:N/VI:N), which matches the described consequences of deleting/re-indexing search indexes and resource exhaustion. No EPSS score, no CISA KEV listing, and no public exploit were provided; by the precision rules this is 'no public exploit identified at time of analysis.' The absence of KEV and EPSS data means real-world exploitation likelihood cannot be quantified from the input. Overall this is a genuine but bounded issue: the CSRF is trivially craftable (AC:L, PR:N), yet exploitation is gated on social-engineering a specific privileged user, and the damage is limited to search-availability disruption rather than code execution or data theft. It is a legitimate fix-in-a-maintenance-window priority, not an emergency, and the high VA:H should not be read as broad criticality given the privileged-victim precondition and availability-only scope.

An attacker crafts a web page containing an auto-submitting form or image tag pointing at the phpMyFAQ Elasticsearch/OpenSearch admin create, drop, or import endpoint, then lures an authenticated administrator with CONFIGURATION_EDIT permission to visit it. Because the endpoints do not validate a CSRF token, the victim's browser silently issues the request, dropping or forcibly re-indexing the search index and degrading or exhausting search functionality. No public exploit code was identified in the provided data, though the attack is simple to reproduce given the described missing token check.