PT-2026-44385 · Phpmyfaq · Phpmyfaq

Kitu232 · Published 2026-05-20 · Updated 2026-05-28 · CVE-2026-35676

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.3

Description An unauthenticated password reset issue exists in the user password update API endpoint. The application allows the password to be changed immediately upon a match of a valid username and email pair without requiring token validation, a confirmation link, or proof of mailbox control. This allows attackers to enumerate valid username and email pairs based on the difference in API responses and force immediate password changes for other users, resulting in account disruption and the invalidation of legitimate credentials. The issue is located in the updatePassword() function within the phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/UnauthorizedUserController.php file. The affected API endpoint is "/api/index.php/user/password/update" using the PUT method, where the username and email variables are processed.

Recommendations Update to version 4.1.3. As a temporary workaround, restrict access to the "/api/index.php/user/password/update" endpoint to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-35676

GHSA-9QV9-8XV6-5P35

Affected Products

Phpmyfaq

References · 5

• 🔥 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9qv9-8xv6-5p35 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35676 · Security Note
• https://osv.dev/vulnerability/GHSA-9qv9-8xv6-5p35 · Vendor Advisory
• https://github.com/thorsten/phpMyFAQ · Note
• https://vulncheck.com/advisories/phpmyfaq-unauthenticated-password-reset-via-user-password-update-endpoint · Note