The vulnerability of the isAddingQuestionsAllowed() function in the phpMyFAQ web application allows a hacker to bypass existing security mechanisms.

The vulnerability of the isAddingQuestionsAllowed function in the phpMyFAQ web application is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow an attacker to bypass existing security measures remotely...

Incorrect Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Incorrect Authorization in the question/create endpoint due to the isAddingQuestionsAllowed method granting access to all callers when...

CVE-2026-85592

phpMyFAQ versions before 4.1.8 are affected by an authorization bypass in the question/create API endpoint. The underlying cause is that the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuestions is enabled, while ignoring the records.allowQuestionsForGuests s...

CVE-2026-85592: Incorrect Authorization

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers ca...