CVE-2026-35676

Technical summary

CVE-2026-35676 is an unauthenticated password reset vulnerability in phpMyFAQ's user password update API endpoint (/api/index.php/user/password/update). The vulnerability stems from missing token validation on PUT requests to this endpoint, classified under CWE-640 (Weak Password Recovery Mechanism). Attackers can enumerate valid username-email combinations and trigger immediate password changes without possessing any credentials or session tokens, resulting in account disruption and credential invalidation for legitimate users.

Business impact

This vulnerability poses an immediate threat to availability and account integrity for any organization running phpMyFAQ. Attackers can systematically lock out users by changing passwords, effectively denying access to FAQ systems and disrupting support operations. The ease of exploitation and absence of authentication requirements mean threat actors can scale attacks across multiple user accounts simultaneously. Organizations dependent on phpMyFAQ for knowledge management or customer support will face operational disruption until accounts are recovered.

Affected systems

phpMyFAQ versions prior to 4.1.3 are vulnerable. Organizations running phpMyFAQ should immediately identify their deployed version number and compare it against the 4.1.3 release threshold. Both on-premises and self-hosted installations are affected. This vulnerability has not been flagged for active KEV exploitation at this time, though the low technical barrier to exploitation suggests monitoring for in-the-wild activity is warranted.

Exploitability

This vulnerability is straightforward to exploit. The attack requires only network access to the API endpoint and can be executed with basic HTTP tools. No authentication, session tokens, or user interaction is required. An attacker can automate enumeration and password reset operations, making this a high-volume attack vector. The CVSS 3.1 score of 8.2 (HIGH severity) reflects the combination of zero prerequisites for exploitation and significant impact on account integrity.

Remediation

Upgrade phpMyFAQ to version 4.1.3 or later, which addresses the token validation vulnerability. Verify the upgrade is complete by confirming the new version number in the application settings. No workarounds exist for this vulnerability short of restricting API endpoint access at the network layer, which may break legitimate functionality.

Patch guidance

Download and apply phpMyFAQ 4.1.3 or a later stable release from the official phpMyFAQ project. Follow the vendor's documented upgrade procedure carefully, including backup of the current installation and database. Test the password reset functionality post-upgrade to confirm token validation is now enforced. If running a load-balanced or multi-instance environment, ensure all instances are updated simultaneously to prevent inconsistent security posture.

Detection guidance

Monitor API logs for unusual PUT requests to /api/index.php/user/password/update, particularly from external IP addresses or in high frequency from single sources. Inspect request patterns for multiple distinct username-email combinations being targeted in short time windows, which may indicate enumeration and mass reset attempts. Alert on successful password changes that were not preceded by user-initiated password reset requests or legitimate administrative actions. Review user access logs for unexpected account lockouts or access failures correlated with these API calls.

Why prioritize this

Prioritize patching immediately. The vulnerability requires no authentication, exploits a foundational security control (password reset), and causes direct harm to account availability. The low attack complexity and complete absence of access barriers make this highly attractive to opportunistic attackers. Even organizations with smaller phpMyFAQ deployments should treat this as urgent due to the potential for rapid, automated exploitation at scale.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects a network-accessible vulnerability with low attack complexity and no authentication requirement (AV:N/AC:L/PR:N). Impact is rated as high integrity compromise and low confidentiality risk. The vulnerability does not directly compromise system availability, hence the 'N' in the A vector, but the ability to force password changes constitutes a severe integrity violation with operational consequences. The HIGH severity assignment is appropriate given the minimal barriers to exploitation.

Frequently asked questions