CVE-2026-76209: phpMyFAQ before v4.1.6 Registration Bypass via API
phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST /api/v3.1/register endpoints, which do not check the configuration flag enforced by the HTML registration page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.6 - Configuration
Ensure phpMyFAQ’s API registration endpoints (/api/register and /api/v3.1/register) validate the configuration flag security.enableRegistration, so account creation is blocked when registration is disabled.
phpMyFAQ security.enableRegistration = validated in API endpoints /api/register and /api/v3.1/register
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker with low privileges can exploit the affected API registration endpoints. No user interaction is required.
Are deployments with registration disabled affected?
Yes. The issue specifically affects deployments that rely on security.enableRegistration to disable account registration, because the affected API endpoints do not validate that setting.
Which endpoints should be reviewed for attempted or unauthorized registrations?
Review requests and account-creation activity associated with POST /api/register and POST /api/v3.1/register. These endpoints can create accounts even when the HTML registration page correctly blocks registration.
What version resolves the issue?
Upgrade phpMyFAQ to v4.1.6 or later. Versions before v4.1.6 are affected.