CVE-2026-119426
Description
A flaw was found in phpMyAdmin. A remote attacker can execute arbitrary database queries by bypassing cross-site request forgery (CSRF) token validation on standard HTTP POST requests. By tricking an authenticated user into submitting a crafted cross-site request, an attacker can execute SQL commands with the privileges of the victim's database account.
Statement
Important impact is assigned to this flaw because unauthorized database commands can be triggered within the context of an authenticated session, potentially resulting in complete compromise of database integrity and confidentiality. Although exploitation hinges on tricking an active user into submitting a forged submission, the full database privileges granted to an administrative victim elevate the risk beyond Moderate severity. phpMyAdmin is not distributed in supported Red Hat Enterprise Linux releases, though it is distributed via community repositories such as EPEL.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
