Which versions of phpMyFAQ are affected by CVE-2026-46362?

phpMyFAQ versions prior to 4.1.2 contain an authorization bypass allowing authenticated administrators to circumvent access controls and view sensitive administrative data, logs, and system…. A patch is available.

How to fix or mitigate CVE-2026-46362?

24 hours: Inventory all phpMyFAQ deployments and determine current versions. 7 days: Upgrade all instances to phpMyFAQ 4.1.2 or later and verify successful deployment. 30 days: Review administrative audit logs for unauthorized access attempts during the vulnerability window and validate that permission controls function correctly.

phpMyFAQ CVE-2026-46362

Q: What is the CVSS score of CVE-2026-46362?

CVE-2026-46362 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30599 HIGH

Incorrect Authorization (CWE-863)

2026-05-15 VulnCheck

GHSA-w9mj-gfrm-hj5x

Authentication Bypass Phpmyfaq

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 28, 2026 - 16:38 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 28, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

May 28, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

May 28, 2026 - 16:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Patch available

May 15, 2026 - 20:02 EUVD

Source Code Evidence Fetched

May 15, 2026 - 19:38 vuln.today

Analysis Generated

May 15, 2026 - 19:38 vuln.today

DescriptionCVE.org

phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after sending a forbidden response. Attackers can access all permission-protected admin pages by requesting their URLs as authenticated users, exposing admin logs, user data, system information, and application configuration.

AnalysisAI

Authorization bypass in phpMyFAQ versions prior to 4.1.2 allows any authenticated administrative user to access all permission-protected admin pages, regardless of their assigned privileges. The flaw resides in AbstractAdministrationController::userHasPermission() which sends a forbidden response but fails to terminate execution, leaking admin logs, user data, system information, and configuration. Publicly available exploit details exist via the GHSA advisory, though EPSS exploitation probability remains very low at 0.04%.

Technical ContextAI

phpMyFAQ is a PHP-based open-source FAQ management system (CPE cpe:2.3:a:thorsten:phpmyfaq) built on the Symfony HttpKernel framework. The root cause is CWE-863 (Incorrect Authorization): the AbstractAdministrationController overrides the parent userHasPermission() method to catch ForbiddenException and send an HTML forbidden page via Symfony Response::send(), but omits any exit(), die(), return, or exception re-throw. Because Response::send() only flushes output buffers and does not halt PHP execution, the calling controller method continues, fetching protected data and emitting a second full Response, effectively defeating the role-based access control layer entirely for any authenticated admin-area session.

RemediationAI

Vendor-released patch: upgrade phpMyFAQ to version 4.1.2 or later, available via Composer (phpmyfaq/phpmyfaq or thorsten/phpmyfaq) per the GHSA-hpgw-ww76-c68r advisory at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hpgw-ww76-c68r. If immediate upgrade is not possible, restrict admin panel access at the web server or reverse proxy layer (e.g., IP allowlist on /admin/ paths) and audit existing low-privilege admin accounts to remove any that are not strictly required; note this does not prevent abuse by any retained authenticated admin user. As an interim code-level mitigation, operators with deployment control can patch the overridden AbstractAdministrationController::userHasPermission() locally to call exit() or re-throw the ForbiddenException after sending the response, with the trade-off of diverging from upstream and complicating future updates.