CVE-2026-85591: phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change
phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data update endpoint with only a CSRF token to silently change any user's password, including administrators, causing irreversible account takeover and victim lockout.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.8 - Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.8Patch Authentication Bypass via Unverified Password Change
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated and have session access. Exploitation also requires a valid CSRF token for the user data update request.
Which accounts can be taken over?
An authenticated attacker can change the password of any user account, including administrator accounts. This can lock the legitimate user out and result in account takeover.
How can I tell whether my deployment is affected?
Deployments running phpMyFAQ versions before 4.1.8 are affected. The vulnerable behavior is in the user control panel API password-change functionality, which accepts a PUT request without verifying the current password.