What is the CVSS score of CVE-2026-49205?

CVE-2026-49205 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-49205?

Yes, a public proof-of-concept exploit is available for CVE-2026-49205. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-49205?

Yes, a patch is available for CVE-2026-49205. Update the affected software to the latest version immediately.

phpMyFAQ CVE-2026-49205

EUVD-2026-37954 MEDIUM

Missing Authorization (CWE-862)

2026-06-18 GitHub_M

GHSA-8c6h-7g6x-m5x4

Authentication Bypass Phpmyfaq Thorsten

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Write-only endpoints create/modify content (I:H); PR:L for required API token; C:N as no data is read or disclosed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 18, 2026 - 23:16 EUVD

Source Code Evidence Fetched

Jun 18, 2026 - 22:16 vuln.today

Analysis Generated

Jun 18, 2026 - 22:16 vuln.today

DescriptionCVE.org

phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed this in the BackupController by adding: $this->userHasPermission(PermissionType::BACKUP). The same fix was not applied to 4 other write endpoints in the public API. All 4 only call $this->hasValidToken() - which checks a shared API key header, rather than the individual user's role permissions. The following APIs are affected: POST /api/v4.0/category (CategoryController::create), POST /api/v4.0/faq (FaqController::create), PUT /api/v4.0/faq (FaqController::update), and POST /api/v4.0/question (QuestionController::create). This issue has been fixed in version 4.1.4.

AnalysisAI

Missing authorization in four write API endpoints of phpMyFAQ prior to version 4.1.4 allows any holder of the shared API key to create categories, create or update FAQs, and post questions regardless of their assigned role permissions. The vulnerability is a partial remediation gap: CVE-2026-24421 previously added userHasPermission checks to BackupController, but that fix was not consistently applied to CategoryController::create, FaqController::create, FaqController::update, and QuestionController::create. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.

Technical ContextAI

phpMyFAQ is a PHP-based open-source FAQ web application exposing a REST API at /api/v4.0/. The API uses a shared API key header validated via $this->hasValidToken() for authentication. The root cause is CWE-862 (Missing Authorization): after token validation, the four affected write endpoints do not call $this->userHasPermission(PermissionType::*), meaning role-based access controls (CATEGORY_ADD, FAQ_ADD, FAQ_EDIT, QUESTION_ADD) are entirely skipped. The affected CPE is cpe:2.3:a:thorsten:phpmyfaq:*:*:*:*:*:*:*:*. Commit d5c195b1ecf5dc30fb825d7eb50d22481c24cb07 shows the fix adds distinct PermissionType imports and userHasPermission calls to each of the three affected controller files, mirroring the pattern already applied to BackupController.

RemediationAI

Upgrade phpMyFAQ to version 4.1.4 or later, which is the vendor-released patch for this issue as confirmed by GitHub Security Advisory GHSA-8c6h-7g6x-m5x4 and commit d5c195b1ecf5dc30fb825d7eb50d22481c24cb07. If immediate upgrade is not feasible, restrict network access to the four affected API paths (POST /api/v4.0/category, POST /api/v4.0/faq, PUT /api/v4.0/faq, POST /api/v4.0/question) via WAF rules or reverse-proxy ACLs - note this will break any legitimate integrations relying on these endpoints. Alternatively, rotate or revoke the shared API key and limit distribution strictly to trusted automated systems until the patch is applied, reducing the pool of potential abusers. Advisory reference: https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8c6h-7g6x-m5x4.