Security Advisory 2026-10-21

Multiple vulnerabilities in phpMyFAQ

Issued on:

2026-10-21

Software:

phpMyFAQ <= 4.1.10

Risk:

High

Platforms:

all

The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.1.10 and earlier.

Description

High severity

The WebAuthn prepare-login endpoint returns stable credential IDs for existing accounts with registered passkeys and rotating credential IDs for unknown accounts, so an unauthenticated attacker can enumerate user accounts and passkeys.

Moderate severity

Insufficient authorization checks allow a delegated group administrator to delete groups with higher privileges than their own.

Solution

The phpMyFAQ Team has released the new phpMyFAQ versions 4.1.11 and 4.2.0-beta.3, which fix these vulnerabilities. All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to one of these versions.

Workaround

There's no workaround except installing phpMyFAQ 4.1.11 or 4.2.0-beta.3.

Thanks

The phpMyFAQ team would like to thank manus-pi and Rully2212 for the responsible disclosures of these vulnerabilities.