CVE-2026-35671: phpMyFAQ - Insecure Direct Object Reference in User Password API
phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials can escalate to SuperAdmin by modifying the userId parameter in the overwrite-password API request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35671?
The severity of CVE-2026-35671 is rated as high with a score of 8.7.
How does CVE-2026-35671 impact phpMyFAQ users?
CVE-2026-35671 allows authenticated low-privileged administrators to change passwords of any user, potentially escalating their privileges.
How do I fix CVE-2026-35671?
To fix CVE-2026-35671, upgrade phpMyFAQ to version 4.1.3 or later.
Who is affected by CVE-2026-35671?
CVE-2026-35671 affects all versions of phpMyFAQ prior to 4.1.3.
What type of vulnerability is CVE-2026-35671?
CVE-2026-35671 is categorized as an insecure direct object reference vulnerability.