CVE-2026-111886
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.
Risk Assessment
An attacker with a hijacked session can permanently disable the victim's two-factor authentication, significantly weakening account protection and facilitating further account takeover.
Recommendation
Upgrade phpMyFAQ to 4.2.0-beta or later and monitor for unusual requests to /api/user/remove-twofactor and other attempts to modify 2FA settings.
Other vulnerabilities in phpMyFAQ
See all- CVE-2026-56736High
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft.
- CVE-2026-57994Medium
A vulnerability in phpMyFAQ before version 4.1.5 allows unauthenticated attackers to retrieve inactive (draft or review-only) FAQ content due to inconsistent filtering in public API endpoints.
- CVE-2026-57961Low
phpMyFAQ before version 4.1.5 contains a path traversal vulnerability in the concatenatePaths() function in Wrapper.php. An authenticated user with FAQ editing privileges can store crafted HTML with image paths that are processed during PDF generation. Lack of path canonicalization and root-directory containment validation may allow reading files outside the intended content directory.
- CVE-2017-15808High
In phpMyFaq before version 2.9.9, there is a CSRF vulnerability in admin/ajax.config.php.
- CVE-2017-15735High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability that allows modification of a glossary.
- CVE-2017-15734High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/stat.main.php.
- CVE-2017-15733High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/ajax.attachment.php and admin/att.main.php.
- CVE-2017-15732High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/news.php.
- CVE-2017-15731High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/stat.adminlog.php.
- CVE-2017-15730High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/stat.ratings.php.
Original NVD description (English source)
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS