Incorrect authorization in phpMyFAQ - CVE-2026-85592
Published: August 21, 2026 / Updated: September 14, 2026
Vulnerability details
The vulnerability allows a remote attacker to submit unauthorized questions to the moderation queue.
The vulnerability exists due to incorrect authorization in QuestionController::isAddingQuestionsAllowed() and the question/create API endpoint when handling unauthenticated question submission requests while the ask-questions feature is enabled. A remote attacker can send a specially crafted request to submit unauthorized questions to the moderation queue.
Only instances with the ask-questions feature enabled and guest submissions disabled are vulnerable. Submitted questions still require administrative review before publication, and exploitation may trigger admin notification emails.