Broken Object-Level Authorization in phpMyFAQ API

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

phpMyFAQ versions 4.0.0 through 4.1.8 and 4.2.0-alpha through 4.2.0-beta1 contain a critical broken object-level authorization flaw in the PUT /api/v3.1/faq/update endpoint. The vulnerability allows authenticated users possessing the global edit_faq permission to modify FAQ entries they should not have access to, including those marked as restricted. This is a privilege escalation attack where coarse-grained permission checks fail to validate fine-grained resource ownership. Organizations running affected phpMyFAQ instances are at risk, particularly those using the platform for sensitive knowledge management where access controls are expected to prevent unauthorized edits, content manipulation, and moderation bypass.

Casky's 283 matching skills, leveraging Claude's extended reasoning capabilities, detect the attack patterns associated with MITRE techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify findings showing: (1) authorization logic gaps where permission checks validate user roles but not resource-level access controls, (2) API endpoint behaviors permitting modification of restricted objects through ID parameter manipulation, and (3) privilege escalation chains where global permissions are misapplied at the object level. The platform's skill mapping would highlight CWE-639 (Authorization Bypass Through User-Controlled Key) patterns, enabling security teams to recognize similar broken authorization vulnerabilities in their own custom APIs and applications before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-111908.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-111908

Casky has 283 skills that investigate the attack patterns behind CVE-2026-111908. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn