EUVD-2026-71013

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...

CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

CVE-2026-85590

phpMyFAQ before 4.1.8 contains an authentication bypass in its two-factor (TOTP) disable functionality . The removeTwofactorConfig() handler at POST /api/user/remove-twofactor checks only session and CSRF token, then disables TOTP without requiring password re-entry or a current TOTP code. The sa...

CVE-2026-85591

phpMyFAQ versions before 4.1.8 contain an authentication bypass in the user control panel API endpoint . The root cause is that the password-change handler does not verify the current password before accepting a new one. An attacker with an existing valid session can submit a PUT request to the u...

CVE-2026-85590 phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication TOTP disable functionality. The removeTwofactorConfig handler reachable via POST /api/user/remove-twofactor verifies only that the user is logged in and that a valid CSRF token is supplied, then...

CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85589

phpMyFAQ before 4.2.0-alpha.2 is affected by a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health. These endpoints enforce only authentication but omit permission checks, allowing any authenticated user—regardless of privilege level—to read site-w...

EUVD-2026-71010

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public...

CVE-2026-85588 phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

CVE-2026-85588

phpMyFAQ versions before 4.1.8 embed live TOTP shared secrets in plaintext inside user data export ZIP files. An attacker who obtains an exported archive can extract the TOTP seed and generate valid one-time codes, effectively bypassing two-factor authentication . The CVSS 4.0 base score is 5.3 (...

CVE-2026-85587

phpMyFAQ versions before 4.1.8 enforce incorrect authorization checks on admin content pages, specifically the news edit and FAQ translate endpoints. This allows users with only add permissions (a lesser-privileged editor role) to read draft and inactive content that is otherwise invisible to the...

CVE-2026-85587 phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public...

CVE-2026-85587 phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public...

CVE-2026-85586

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. This allows unauthenticated attackers to bypass CAPTCHA protection and submit unlimited questions directly, resulting in database pollution and triggering outgoing mai...

CVE-2026-85586 phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications...

The vulnerability in the `src/phpMyFAQ/Controller/Frontend/AuthenticationController.php` file of the phpMyFAQ web application allows a violator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the src/phpMyFAQ/Controller/Frontend/AuthenticationController.php file in the phpMyFAQ web application is related to insufficient limits on authentication attempts. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the...

CVE-2026-76214

phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, allowing an attacker who captures a...

CVE-2026-76215

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...

CVE-2026-76213

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cook...