CVE-2026-116183
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Oct 25, 2026
Vendor
unknown
Description
phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.