CVE-2026-49205: phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

June 23, 2026

CVE-2026-24421 fixed BackupController by adding: $this->userHasPermission(PermissionType::BACKUP);

The same fix was NOT applied to 4 other write endpoints in the public API. All 4 only call $this->hasValidToken() — which checks a shared API key header, NOT the individual user’s role permissions.

References

github.com/advisories/GHSA-8c6h-7g6x-m5x4
github.com/thorsten/phpMyFAQ/commit/d5c195b1ecf5dc30fb825d7eb50d22481c24cb07
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8c6h-7g6x-m5x4
nvd.nist.gov/vuln/detail/CVE-2026-49205

Code Behaviors & Features

Detect and mitigate CVE-2026-49205 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →