6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49205

CVE-2026-49205: phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed this in the BackupController by adding: $this->userHasPermission(PermissionType::BACKUP). The same fix was not applied to 4 other write endpoints in the public API. All 4 only call $this->hasValidToken() — which checks a shared API key header, rather than the individual user's role permissions. The following APIs are affected: POST /api/v4.0/category (CategoryController::create), POST /api/v4.0/faq (FaqController::create), PUT /api/v4.0/faq (FaqController::update), and POST /api/v4.0/question (QuestionController::create). This issue has been fixed in version 4.1.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49205

CVE-2026-49205:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
thorsten/phpmyfaq	composer	< 4.1.4	4.1.4
phpmyfaq/phpmyfaq	composer	< 4.1.4	4.1.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a missing authorization check in four API write endpoints of phpMyFAQ. The affected functions only validated the API token using hasValidToken() but did not check for user-specific permissions using userHasPermission(). This allowed any authenticated user with an API token to perform administrative actions such as creating categories, FAQs, and questions, regardless of their assigned roles and permissions. The analysis of the fixing commit d5c195b1ecf5dc30fb825d7eb50d22481c24cb07 clearly shows the addition of the necessary userHasPermission() calls in the vulnerable functions, confirming the flaw. These functions are the exact locations in the code that would be executed during an exploit and would appear in a runtime profile.

Vulnerable functions

phpMyFAQ\Controller\Api\CategoryController::create

src/phpMyFAQ/Controller/Api/CategoryController.php

The 'create' function in the 'CategoryController' is vulnerable because it only checks for a valid API token ('hasValidToken()') but does not verify if the user has the specific permission to add a category. This allows any user with a valid API token to create categories, regardless of their user role. The patch adds the missing 'userHasPermission(PermissionType::CATEGORY_ADD)' check to enforce proper authorization.

phpMyFAQ\Controller\Api\FaqController::create

src/phpMyFAQ/Controller/Api/FaqController.php

The 'create' function in the 'FaqController' is vulnerable because it only checks for a valid API token ('hasValidToken()') but does not verify if the user has the specific permission to add a FAQ entry. This allows any user with a valid API token to create FAQ entries, regardless of their user role. The patch adds the missing 'userHasPermission(PermissionType::FAQ_ADD)' check to enforce proper authorization.

phpMyFAQ\Controller\Api\FaqController::update

src/phpMyFAQ/Controller/Api/FaqController.php

The 'update' function in the 'FaqController' is vulnerable because it only checks for a valid API token ('hasValidToken()') but does not verify if the user has the specific permission to edit a FAQ entry. This allows any user with a valid API token to update any FAQ entry, regardless of their user role. The patch adds the missing 'userHasPermission(PermissionType::FAQ_EDIT)' check to enforce proper authorization.

phpMyFAQ\Controller\Api\QuestionController::create

src/phpMyFAQ/Controller/Api/QuestionController.php

The 'create' function in the 'QuestionController' is vulnerable because it only checks for a valid API token ('hasValidToken()') but does not verify if the user has the specific permission to add a question. This allows any user with a valid API token to create questions, regardless of their user role. The patch adds the missing 'userHasPermission(PermissionType::QUESTION_ADD)' check to enforce proper authorization.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-49205: phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

CVE-2026-49205:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-49205: phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

Technical Details

Basic Information

Basic Information

6.5

6.5

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-49205: phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

CVE-2026-49205:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-49205: phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

Technical Details

Basic Information

Basic Information

6.5

6.5

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI