{"action":"Upgrade thorsten/phpmyfaq to 4.1.4 or later.","affected":[{"fixed":"4.1.4","introduced":"0"}],"component":"thorsten/phpmyfaq","cve_ids":["CVE-2026-56396"],"ecosystem":"Packagist","epss":0.00442,"exploited":false,"fixed_versions":["4.1.4"],"ghsa_id":"GHSA-985r-q3qp-299h","id":"tcs_01M5KEZTA80QJX04T8K3F4E7CN","modified_at":"2026-09-10T03:50:49.089361139Z","published_at":"2026-06-26T21:23:37Z","references":["https://osv.dev/vulnerability/GHSA-985r-q3qp-299h","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-985r-q3qp-299h","https://github.com/thorsten/phpMyFAQ"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-985r-q3qp-299h","url":"https://osv.dev/vulnerability/GHSA-985r-q3qp-299h"}],"summary":"phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards"}