Incorrect authorization in phpMyFAQ - CVE-2026-85592

 

Incorrect authorization in phpMyFAQ - CVE-2026-85592

Published: August 21, 2026 / Updated: September 14, 2026


Vulnerability identifier: #VU144536
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85592
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to submit unauthorized questions to the moderation queue.

The vulnerability exists due to incorrect authorization in QuestionController::isAddingQuestionsAllowed() and the question/create API endpoint when handling unauthenticated question submission requests while the ask-questions feature is enabled. A remote attacker can send a specially crafted request to submit unauthorized questions to the moderation queue.

Only instances with the ask-questions feature enabled and guest submissions disabled are vulnerable. Submitted questions still require administrative review before publication, and exploitation may trigger admin notification emails.


Affected software

phpMyFAQ

How to mitigate CVE-2026-85592

Install security update from vendor's website.

phpMyFAQ - update to 4.1.8

External References

Related Security Bulletins