Executive brief
phpMyFAQ, an open-source FAQ software, contains a flaw in its password reset system. An attacker can force a password change for any user if they know the user's username and email address. This results in legitimate users being locked out of their accounts, causing significant operational disruption and requiring manual administrative intervention to restore access.
Technical details
A vulnerability exists in the `UnauthorizedUserController.php` component of phpMyFAQ due to a weak password recovery mechanism (CWE-640). The API endpoint `/api/index.php/user/password/update` processes PUT requests and immediately updates a user's password in the database if the provided username and email match, without requiring a reset token or out-of-band confirmation. An unauthenticated remote attacker can exploit this to invalidate legitimate user credentials and perform account enumeration based on the server's response (200 OK for success vs 409 Conflict for mismatches). While the new password is sent to the victim's email, the immediate invalidation of the existing password constitutes a denial-of-service against user accounts. This issue is resolved in version 4.1.3.
Affected products
- thorsten phpMyFAQ < 4.1.3
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published by maintainer
- 2026-05-28: disclosed: CVE published to NVD dataset
- 2026-05-28: patched: Fix confirmed available in version 4.1.3