high7.5
CVE-2026-116183
phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor questi…
Impact
phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.
Affected products
| Product | Affected versions |
|---|---|
| PhpMyFAQ | before 4.1.10 |
Versions were read from the advisory text. No structured product data has been published for this record yet.