SB20261110338 - Multiple vulnerabilities in phpMyFAQ

Description

This security bulletin contains information about 2 vulnerabilities.

1) Observable Response Discrepancy (CVE-ID: N/A)

CWE-ID: CWE-204 - Observable Response Discrepancy

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to enumerate passkey-enabled accounts, disclose credential IDs, and disrupt passkey authentication.

The vulnerability exists due to observable response discrepancies between stable stored credential IDs and rotating fallback IDs, alongside unauthenticated challenge updates, in phpMyFAQ's WebAuthn login preparation when WebAuthn support is enabled and passkeys are registered. A remote attacker can send requests to POST /api/webauthn/prepare-login more than one second apart to identify passkey-enabled accounts by comparing credential IDs, or repeatedly overwrite login challenges to prevent successful passkey authentication.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to delete higher-privileged groups, revoke group-based administrative access, and disrupt administration.

The vulnerability exists due to incorrect authorization in phpMyFAQ's group confirmation and deletion endpoints when processing target group identifiers with security.permLevel=medium, without verifying authority over the target group's permissions. A remote privileged user can use delegated delgroup permission to submit a target identifier to /admin/group/confirm, obtain a valid CSRF token, and submit /admin/group/delete to remove the group, its memberships, and its permission mappings.

Remediation

Install update from vendor's website.

References

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-2rvx-pqfw-q35r
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwq