CVE-2026-75918: phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.7 - Operational
After upgrading phpMyFAQ, assume any password reset tokens exposed via the publicly accessible tracking file (content/core/data/trackingDDMMYYYY) may have been stolen and replayed; invalidate/force re-issuance of password reset tokens (e.g., require users to request new password resets).
Event History
Frequently Asked Questions
Who is exposed to this issue?
phpMyFAQ deployments before 4.1.7 are exposed when user tracking is enabled and the tracking file is publicly accessible. An attacker does not need an account to retrieve tokens from the exposed file.
What does an attacker need to take over an account?
The attacker needs access to the publicly accessible daily tracking file at content/core/data/trackingDDMMYYYY and a password reset token recorded there. They can replay the extracted token against the password reset API.
Is the default configuration affected?
The issue is described as occurring when user tracking is enabled. The provided information does not state whether user tracking is enabled by default.
How can I check whether my deployment may already be exposed?
Check whether user tracking is enabled and whether files matching content/core/data/trackingDDMMYYYY can be requested without authentication. Also review whether password reset tokens may have been written to those tracking files.