CVE-2026-111892: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints
phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects phpMyFAQ 4.2.0-alpha releases before 4.2.0-beta. The affected password-reset endpoints are user/password/update and user/password/reset.
What does an attacker need to exploit this?
An attacker does not need authentication or user interaction. They can repeatedly submit password-reset requests against a registered user's account.
What is the practical impact?
Attackers can flood a registered user's inbox with password-reset emails and consume mailer and server resources. The reported impact is limited to integrity and availability; no confidentiality impact is indicated.
Is a default deployment exposed?
The affected endpoints are unauthenticated, so deployments exposing them are susceptible unless they have compensating rate limits outside phpMyFAQ.