Security Advisory - Published 2026-06-22 - Self-hosted Apps
Craft CMS, phpMyFAQ, House-Rental, and Capgo: check versions and app logs
This batch covers public-facing self-hosted applications. The practical question is whether the vulnerable app was reachable and whether users, roles, database records, environment access, or PostgreSQL telemetry changed before the patch.
Affected systems
| CVE | Product | Affected | Review | CVSS |
|---|---|---|---|---|
| CVE-2026-56396 | phpMyFAQ | before 4.1.4 | admin user changes, rights changes, and FAQ admin logs | 8.8 |
| CVE-2026-56382 | Craft CMS | 5.5.0 through 5.9.13 | Composer lock files, admin field-layout changes, environment access, and logs | 8.6 |
| CVE-2026-12775 | Montodel House-Rental-Management | rolling release before the reported fix state | login logs, rental records, database errors, and changed users | 7.5 |
| CVE-2026-56282 | Capgo | before 12.128.2 | replication endpoint exposure, PostgreSQL logs, and deployment telemetry | 6.9 |
Owner self-check
grep -Rni 'craftcms/cms\\|phpmyfaq\\|Capgo\\|House-Rental' composer.json composer.lock package.json pnpm-lock.yaml yarn.lock 2>/dev/null
find . -type f -mtime -10 | egrep '\\.php$|\\.phtml$|\\.env$|\\.sql$|\\.log$|composer\\.lock|package-lock\\.json'
grep -Rni 'superadmin\\|rights\\|field layout\\|replication\\|postgres\\|login\\|sql error' storage logs var/log 2>/dev/null
grep -Rni 'CRAFT_SECURITY_KEY\\|DB_PASSWORD\\|DATABASE_URL' .env config 2>/dev/nullWhat to review
- Craft CMS admin field-layout changes, Composer version, environment access, and admin sessions.
- phpMyFAQ administrators, rights changes, user edits, and FAQ admin activity.
- House-Rental login errors, database errors, changed rental records, and changed user accounts.
- Capgo replication endpoint exposure, PostgreSQL logs, deployment telemetry, and public routes.
Safe fix path
- Patch to the fixed release where available. Remove unsupported public apps from exposure.
- Preserve web, app, database, and deployment logs before cleanup.
- Rotate database credentials, application keys, API keys, and admin passwords if exposure is confirmed.
- Recheck public routes after patching; stale proxies and old containers can keep vulnerable code reachable.
Repair help
Use Ping7 CVE Repair when a self-hosted app was public, admin rights changed, database records look wrong, or logs need review before the system is returned to normal traffic.