Executive brief
phpMyFAQ, an open-source knowledge base system, contains a critical flaw in how it handles password resets. An unauthorized attacker can force the system to reset any user's password—including administrative accounts—simply by knowing their username and email address. This allows an attacker to take full control of the knowledge base, potentially exposing private documentation, modifying content, or locking out legitimate users.
Technical details
An authentication bypass exists in the `updatePassword()` method of the `UnauthorizedUserController.php` component in phpMyFAQ. The API endpoint `/api/user/password/update` processes PUT requests using only a username and email address without requiring a cryptographic reset token or prior email verification. Because the endpoint also lacks rate limiting, attackers can enumerate valid account details and trigger an immediate password reset. Upon a successful request, the system generates a new plaintext password and sends it to the user's email, effectively allowing an attacker who has compromised the recipient's email or can predict the reset behavior to achieve full account takeover. The vulnerability is addressed in version 4.1.3.
Affected products
- thorsten phpMyFAQ < 4.1.3
Timeline
- 2026-05-14: advisory: Vendor advisory published on GitHub
- 2026-05-28: disclosed: NVD publication date
- 2026-05-28: patched: Fix confirmed in version 4.1.3