CVE-2026-85592

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers ca...

CVE-2026-85586

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. This allows unauthenticated attackers to bypass CAPTCHA protection and submit unlimited questions directly, resulting in database pollution and triggering outgoing mai...