CVE-2026-49205

🎯 CVE-2026-49205 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-49205 | phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed this in the BackupController by adding: $this->userHasPermission(PermissionType::BACKUP). The same fix was not applied to 4 other write endpoints in the public API. All 4 only call $this->hasValidToken() — which checks a shared API key header, rather than the individual user's role permissions. The followi

phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed this in the BackupController by adding: $this->userHasPermission(PermissionType::BACKUP). The same fix was not applied to 4 other write endpoints in the public API. All 4 only call $this->hasValidToken() — which checks a shared API key header, rather than the individual user's role permissions. The following APIs are affected: POST /api/v4.0/category (CategoryController::create), POST /api/v4.0/faq (FaqController::create), PUT /api/v4.0/faq (FaqController::update), and POST /api/v4.0/question (QuestionController::create). This issue has been fixed in version 4.1.4.

Klassifikation & Betroffenheit:

CWE-862 thorsten phpMyFAQ < 4.1.4

Missing Authorization 🎯 High

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

🛡️ Empfohlene Mitigation: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-665 · Exploitation of Thunderbolt Protection F… (Very High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1211 · Exploitation for Defensive Evasion T1542.002 · Pre-OS Boot: Component Firmware T1556 · Modify Authentication Process

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-85574 8.0 CVE-2026-14873 8.0 CVE-2026-59690 8.0 CVE-2026-15293 8.0 CVE-2025-48640 8.0

🩹 Patch verfügbar (OSV):

🩹 12239894c0c7913885a1928fb0ce689bbf18eb34 (Commit) 🩹 d5c195b1ecf5dc30fb825d7eb50d22481c24cb07 (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 06/2026

Heute 05.11.

CVSS-Vektor-Analyse: 6.5

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Gering

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Keine

A · Verfügbarkeit Keine

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CNA-Bewertung (GitHub_M): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Veröffentlicht:18.06.2026

Aktualisiert:26.10.2026 11:10

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2026-37954

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-862 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	786	0,2 %
≥50 %	3.570	0,9 %
≥10 %	23.060	5,7 %
<10 %	380.695	93,3 %

Tier

CVEs

Anteil

≥90 %

786

0,2 %

≥50 %

3.570

0,9 %

≥10 %

23.060

5,7 %

<10 %

380.695

93,3 %

6.5 MEDIUM

EPSS

0.4%

CVE-2026-49205 🌐 Netzwerk (Remote) 🔑 Geringe Nutzerrechte nötig

thorsten

CVE-2026-49205 | phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed this in the BackupController by adding: $this->userHasPermission(PermissionType::BACKUP). The same fix was not applied to 4 other write endpoints in the public API. All 4 only call $this->hasValidToken() — which checks a shared API key header, rather than the individual user's role permissions. The followi

CWE-862 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 4 Monaten ↻ vor 4 Monaten

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub