phpMyFAQ CVE-2026-111907

Exploitation requires that a user already authenticated to phpMyFAQ AND holding the CONFIGURATION_EDIT permission be tricked (UI:P) into submitting a cross-site request to the POST /admin/api/update-database endpoint, which performs database migrations without validating a CSRF token. Affected versions are 4.0.0 up to (but not including) 4.1.9. Limiting factors that reduce real-world risk: the victim must be a privileged administrator with an active session, active user interaction is mandatory (the attack cannot fire unattended), and upgrading to 4.1.9 or later remediates it. There is no unauthenticated server-side trigger - the attacker rides the victim's existing privileges.

This is a moderate-severity CSRF flaw (CWE-352) rated CVSS 4.0 7.1, and the signals are internally consistent rather than conflicting. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P reflects CSRF accurately: the attacker needs no privileges of their own (PR:N) but does require victim interaction (UI:P) - specifically a logged-in phpMyFAQ user holding the CONFIGURATION_EDIT permission must be lured into submitting the crafted request. Impact is scoped to integrity and availability of the database (VI:L/VA:H) with no confidentiality exposure (VC:N), which matches the description of triggering uncontrolled database migrations. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input; absence of these is not evidence of low risk but means there is no signal of active or imminent exploitation. On balance this is a real but conditional issue, not a drop-everything emergency: realistic exploitation depends on social-engineering a privileged administrator, which bounds the blast radius to a targeted scenario rather than mass/automatable exploitation. The headline CVSS 7.1 is driven largely by the high availability impact; the practical priority should be weighed against the fact that only high-permission admin accounts are viable victims.

An attacker crafts a malicious web page or email containing an auto-submitting form (or image/fetch) that issues a POST to /admin/api/update-database and socially engineers a currently-logged-in phpMyFAQ administrator with CONFIGURATION_EDIT rights into visiting it. Because the endpoint does not validate a CSRF token, the victim's authenticated session silently executes database migrations, potentially corrupting schema/data or rendering the FAQ database unavailable. No public exploit code was identified in the provided data, so exploitation would require the attacker to build the request from the advisory details.