CVE-2026-35672: phpMyFAQ - Authentication Bypass via Empty API Token
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not use the default empty api.apiClientToken. Configure api.apiClientToken to a non-empty secret value so requests must present a valid token to access the API.
phpMyFAQ API api.apiClientToken = non-empty token - Configuration
Enforce token validation by rejecting empty x-pmf-token headers (do not treat an empty header as valid). Ensure POST endpoints require a non-empty x-pmf-token.
phpMyFAQ API x-pmf-token validation = reject empty - Compensating control
Until the application is remediated, restrict access to API v4.0 endpoints — especially POST /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question — using network controls (firewall/IP allowlist) or a web application firewall to block unauthenticated requests.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35672?
CVE-2026-35672 has a high severity rating of 8.7.
How do I fix CVE-2026-35672?
To fix CVE-2026-35672, upgrade to phpMyFAQ version 4.1.3 or later.
What vulnerability is addressed in CVE-2026-35672?
CVE-2026-35672 addresses an authentication bypass vulnerability via an empty API token.
What can attackers do with CVE-2026-35672?
Attackers can exploit CVE-2026-35672 to create and modify FAQ entries without authentication.
Which version of phpMyFAQ is affected by CVE-2026-35672?
CVE-2026-35672 affects phpMyFAQ versions prior to 4.1.3.