Weak Password Recovery Mechanism for Forgotten Password in phpMyFAQ - #VU131754
Published: May 18, 2026
Vulnerability identifier: #VU131754
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-640
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to take over arbitrary user accounts.
The vulnerability exists due to a weak password recovery mechanism in the /api/user/password/update endpoint when handling password reset requests. A remote attacker can send a specially crafted PUT request containing a valid username and associated email address to take over arbitrary user accounts.
The issue can be used against administrative accounts, including SuperAdmin accounts, and no user interaction is required.
Affected software
phpMyFAQ
Remediation
Install security update from vendor's website.
phpMyFAQ - update to 4.1.3