SB2026082147 - Multiple vulnerabilities in phpMyFAQ

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082147

SB2026082147 - Multiple vulnerabilities in phpMyFAQ

Published: August 21, 2026

Security Bulletin ID SB2026082147
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 14% Low 86%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Improper control of interaction frequency (CVE-ID: N/A)

CWE-ID: CWE-799 - Improper Control of Interaction Frequency

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to submit forged open questions and trigger notification emails.

The vulnerability exists due to improper control of interaction frequency in the open-question submission endpoint when processing requests with the store=now parameter. A remote attacker can send a specially crafted request to submit forged open questions and trigger notification emails.

Only instances with anonymous question submission enabled are vulnerable.


2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose unpublished content.

The vulnerability exists due to incorrect authorization in admin news edit and faq translate pages when handling requests for protected content records. A remote user can request the affected admin pages with only add-level permissions to disclose unpublished content.

The issue affects inactive news drafts and inactive FAQs that are not publicly accessible.


3) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive authentication information.

The vulnerability exists due to exposure of sensitive information in the user data export endpoint when processing a self-service data export request. A remote user can request a data export archive to disclose sensitive authentication information.

The exported userdata.json contains the live TOTP shared secret in plaintext, which remains valid until two-factor authentication is reset.


4) Use of Single-factor Authentication (CVE-ID: N/A)

CWE-ID: CWE-308 - Use of Single-factor Authentication

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disable two-factor authentication for the current account.

The vulnerability exists due to use of single-factor authentication in the user API endpoints when handling requests to disable two-factor authentication or update the twofactor_enabled setting. A remote user can send a specially crafted request with a valid session cookie and CSRF token to disable two-factor authentication for the current account.

This affects both the POST /api/user/remove-twofactor endpoint and the inline toggle via PUT /api/user/data/update.


5) Unverified Password Change (CVE-ID: N/A)

CWE-ID: CWE-620 - Unverified Password Change

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to change an account password and take over the account.

The vulnerability exists due to unverified password change in the user control panel API endpoint `PUT /api/user/data/update` when processing authenticated password update requests. A remote user can send a crafted password change request without supplying the current password to change an account password and take over the account.

Any session-level compromise, such as script execution in the user's browser context, a stolen session cookie, or an unattended unlocked session, can be leveraged to perform the password change silently, and existing sessions are invalidated after the change.


6) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to submit unauthorized questions to the moderation queue.

The vulnerability exists due to incorrect authorization in QuestionController::isAddingQuestionsAllowed() and the question/create API endpoint when handling unauthenticated question submission requests while the ask-questions feature is enabled. A remote attacker can send a specially crafted request to submit unauthorized questions to the moderation queue.

Only instances with the ask-questions feature enabled and guest submissions disabled are vulnerable. Submitted questions still require administrative review before publication, and exploitation may trigger admin notification emails.


7) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in FaqHelper::convertOldInternalLinks() when processing sanitized FAQ answer content containing a legacy-format internal URL. A remote user can create or edit an FAQ entry with crafted content to execute arbitrary script in a victim's browser.

User interaction is required to view the affected frontend FAQ page.


Remediation

Install update from vendor's website.

References