CVE-2026-35676: phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint
phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sending PUT requests to the /api/index.php/user/password/update endpoint, causing account disruption and invalidating legitimate user credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35676?
The severity of CVE-2026-35676 is rated as high with a score of 8.8.
How do I fix CVE-2026-35676?
To fix CVE-2026-35676, upgrade phpMyFAQ to version 4.1.3 or later.
What kind of vulnerability is CVE-2026-35676?
CVE-2026-35676 is an unauthenticated password reset vulnerability found in the user password update API endpoint.
What is the impact of CVE-2026-35676?
The impact of CVE-2026-35676 allows attackers to change account passwords without proper authentication, which can lead to account takeovers.
Can CVE-2026-35676 be exploited remotely?
Yes, CVE-2026-35676 can be exploited remotely as it does not require authentication for the password reset process.