Unverified Password Change in phpMyFAQ - CVE-2026-85591
Published: August 21, 2026 / Updated: September 14, 2026
Vulnerability details
The vulnerability allows a remote user to change an account password and take over the account.
The vulnerability exists due to unverified password change in the user control panel API endpoint `PUT /api/user/data/update` when processing authenticated password update requests. A remote user can send a crafted password change request without supplying the current password to change an account password and take over the account.
Any session-level compromise, such as script execution in the user's browser context, a stolen session cookie, or an unattended unlocked session, can be leveraged to perform the password change silently, and existing sessions are invalidated after the change.