SB2026080470 - Multiple vulnerabilities in phpMyFAQ

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080470

SB2026080470 - Multiple vulnerabilities in phpMyFAQ

Published: August 4, 2026

Security Bulletin ID SB2026080470
CSH Severity
High
Patch available
YES
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 12% Medium 71% Low 18%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 vulnerabilities.


1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to create new user accounts despite registration being disabled.

The vulnerability exists due to missing authorization in the registration API controllers when handling registration requests while security.enableRegistration is disabled. A remote user can send crafted registration requests to create new user accounts despite registration being disabled.

If spam.manualActivation is disabled, created accounts may be activated automatically.


2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to missing authorization in the attachments API endpoint when handling requests for attachments by FAQ record ID. A remote attacker can send a specially crafted request for a restricted FAQ record ID to disclose sensitive information.

Exposed data can include attachment filenames, generated attachment URLs, and the existence of attachments for restricted FAQ records. The advisory states that file contents were not disclosed in the demonstrated reproduction.


3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to missing authorization in frontend FAQ comment rendering when rendering a restricted FAQ page. A remote attacker can request a restricted FAQ page to disclose sensitive information.

The page can display an access-denied FAQ body while still rendering the associated comment content and commenter information.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to missing authorization in the comments API endpoint when handling requests for comments by FAQ record ID. A remote attacker can send a specially crafted request for a restricted FAQ record ID to disclose sensitive information.

Exposed data can include comment text, commenter usernames, email addresses, timestamps, and the existence of comments for restricted FAQ records.


5) Authentication Bypass by Capture-replay (CVE-ID: N/A)

CWE-ID: CWE-294 - Authentication Bypass by Capture-replay

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass WebAuthn authentication by replaying a captured assertion.

The vulnerability exists due to missing critical step in authentication in the WebAuthn login flow when processing login assertions. A remote attacker can replay a captured login request body to bypass WebAuthn authentication by replaying a captured assertion.

The per-login challenge generated by prepareForLogin is not persisted, so the stored challenge is missing and the anti-replay check is skipped by a null guard. No user interaction or hardware key use is required once a valid assertion has been captured.


6) Improper Restriction of Excessive Authentication Attempts (CVE-ID: N/A)

CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass two-factor authentication and gain access to an administrator account.

The vulnerability exists due to improper restriction of excessive authentication attempts in the authentication controller 2FA flow when handling repeated token submissions across fresh sessions or password re-authentication. A remote attacker can submit repeated guessed TOTP codes to bypass two-factor authentication and gain access to an administrator account.

Exploitation requires knowledge of the victim's password. The failed-attempt counter is tracked only in the session, is reset on successful password authentication, and the token verifier does not record previously tried or previously accepted codes.


7) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: N/A)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper neutralization of wildcard characters in PostgreSQL search backend when processing user-supplied search terms. A remote attacker can submit search terms containing % or _ characters to cause a denial of service.

Only deployments using the native PostgreSQL pgsql extension backend are vulnerable; the PDO PostgreSQL backend is not affected.


8) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in admin configuration and dashboard read API endpoints when handling authenticated requests to admin API routes. A remote user can send requests to affected endpoints to disclose sensitive information.

The LDAP configuration endpoint returns directory host, port, bind account name, search base, mappings, options, and group configuration, while the LDAP password is masked. Additional affected endpoints expose search backend statistics and health data, dashboard verification results, and aggregate analytics.


9) Information Exposure Through an Error Message (CVE-ID: N/A)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to generation of error messages containing sensitive information in the PDF export HTML image handling path when processing crafted FAQ HTML during PDF generation. A remote user can store a crafted <img> tag that references a local file under the content/ directory to disclose sensitive information.

After the crafted FAQ content has been published, the disclosure can be triggered by requesting the PDF export endpoint, and larger portions of file contents may be exposed when the PHP exception string length setting is increased.


10) Inclusion of Sensitive Information in Log Files (CVE-ID: N/A)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to take over accounts.

The vulnerability exists due to insertion of sensitive information into log files in the user tracking feature and password reset handling when logging frontend requests containing password reset query strings to a publicly accessible tracking file. A remote attacker can read the exposed tracking file and replay leaked reset parameters to take over accounts.

User interaction is required because a target user must open a valid password reset link before the leaked reset parameters can be reused.


11) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass an administrative account block and regain access to the application.

The vulnerability exists due to improper access control in the LDAP authentication flow when processing a successful LDAP login for a pre-existing blocked local account. A remote attacker can authenticate with valid LDAP credentials matching a blocked local account to bypass an administrative account block and regain access to the application.

The blocked-to-active state change is not logged as a security event.


12) Missing Critical Step in Authentication (CVE-ID: N/A)

CWE-ID: CWE-304 - Missing Critical Step in Authentication

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass two-factor authentication and fully compromise an account.

The vulnerability exists due to missing critical steps in authentication in the remember-me authentication flow when processing a login with the remember-me option enabled and a subsequent cookie-based login. A remote user can obtain a remember-me cookie before second-factor verification and replay that cookie to bypass two-factor authentication and fully compromise an account.

The issue affects accounts with two-factor authentication enabled, and the attacker must possess valid username and password credentials.


13) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the public PDF export endpoint when handling requests for inactive or deactivated FAQ records. A remote attacker can send a specially crafted request to disclose sensitive information.

On affected configurations, the issue can expose the FAQ title, solution id, author name, and last-update date, while the answer body is redacted. The record must already be in a guest-readable category.


14) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands and disclose sensitive information.

The vulnerability exists due to SQL injection in GlossaryRepository::create and GlossaryRepository::update when handling glossary create or update requests. A remote user can submit a specially crafted glossary item and definition to execute arbitrary SQL commands and disclose sensitive information.

The issue is triggered by truncating the escaped glossary item before it is embedded in a quoted SQL literal, which can leave a dangling backslash that causes the definition field to be interpreted as SQL.


15) Files or Directories Accessible to External Parties (CVE-ID: N/A)

CWE-ID: CWE-552 - Files or Directories Accessible to External Parties

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to files accessible to external parties in the content backup API when creating and downloading a content backup. A remote attacker can race requests to retrieve a leftover or temporarily exposed content.zip file to disclose sensitive information.

User interaction is required to trigger backup creation in the affected workflow.


16) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disable maintenance mode and trigger database migration.

The vulnerability exists due to missing authentication for a critical function in the setup update-database endpoint when maintenance mode is enabled and the application handles an update request. A remote attacker can send a specially crafted request to disable maintenance mode and trigger database migration.

A successful migration sets main.maintenanceMode=false.


17) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to create a backup archive containing sensitive configuration files.

The vulnerability exists due to missing authentication for a critical function in the setup backup endpoint when maintenance mode is enabled and the application handles a backup request. A remote attacker can send a specially crafted request to create a backup archive containing sensitive configuration files.

The issue is reachable only while maintenance mode is enabled, and the created archive is written under content/core/config/.


Remediation

Install update from vendor's website.

References