CVE-2026-35671

Technical summary

CVE-2026-35671 is an Insecure Direct Object Reference (IDOR) vulnerability in phpMyFAQ's admin API password endpoint. The overwrite-password function fails to verify that the requesting administrator has authorization to modify the target user's credentials. By tampering with the userId parameter, a low-privilege admin can change SuperAdmin passwords, achieving full privilege escalation. The vulnerability affects all versions prior to 4.1.3.

Business impact

A compromised FAQ system can disrupt knowledge management operations and customer support functions. More critically, successful exploitation grants attackers administrative control, enabling defacement, data theft, user account compromise, and lateral movement within connected infrastructure. Organizations using phpMyFAQ for customer-facing documentation face reputational risk and potential compliance violations if user data is accessed or modified.

Affected systems

phpMyFAQ installations prior to version 4.1.3 are vulnerable. The vulnerability requires valid administrator credentials to exploit, limiting the immediate attack surface to environments where admin account compromise or insider threats are plausible. Organizations running current or patched versions are not affected.

Exploitability

Exploitation requires low-level administrator access, making this a post-authentication attack. No user interaction is needed once authenticated. An attacker can programmatically craft API requests to reset SuperAdmin passwords with minimal technical overhead. The attack is reliable and leaves minimal forensic traces if logging is not configured. The relatively straightforward exploitation mechanism and high privilege reward make this attractive to both insider threats and attackers who have compromised a standard admin account.

Remediation

Upgrade phpMyFAQ to version 4.1.3 or later, which implements proper authorization verification on the password change endpoint. Organizations unable to patch immediately should restrict admin API access via network segmentation, enforce strong password policies to reduce likelihood of admin account compromise, and increase monitoring of password change activities.

Patch guidance

Apply phpMyFAQ 4.1.3 or later. Verify the patch against the official phpMyFAQ release notes and advisory documentation. Test patches in a non-production environment before deployment. After patching, rotate all administrator passwords as a precautionary measure, since any historical admin access may have been abused.

Detection guidance

Monitor API audit logs for repeated failed or successful overwrite-password requests, particularly those originating from unusual source IPs or executed by lower-privilege admins. Look for password change requests followed by immediate administrative activity from new accounts. Configure alerting on any password modifications to SuperAdmin or high-privilege accounts. Correlation of API requests with user authentication logs can reveal abuse patterns.

Why prioritize this

This vulnerability scores 8.8 (HIGH severity) and enables full system compromise via privilege escalation. Although it requires authenticated access, the barrier is low—compromise of a single standard admin account leads to complete takeover. Organizations should prioritize patching within their standard critical update cycles, especially if their phpMyFAQ instances are internet-facing or support high-value business processes.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability (C:H, I:H, A:H), network-based attack vector (AV:N), and low attack complexity (AC:L). The primary limiting factor is the requirement for prior authentication (PR:L), which prevents a zero-day remote takeover scenario but does not significantly reduce risk in environments where admin credentials are at moderate risk of compromise.

Frequently asked questions