# CVE-2026-35676: phpMyFAQ unauthenticated password reset in user password update API

Source: https://junglewise.ai/threats/cve-2026-35676-phpmyfaq-unauthenticated-password-reset-in-user-password-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-35676 · Severity: high · CVSS 8.2 · Published 2026-05-28

phpMyFAQ, an open-source FAQ software, contains a flaw in its password reset system. An attacker can force a password change for any user if they know the user's username and email address. This results in legitimate users being locked out of their accounts, causing significant operational disruption and requiring manual administrative intervention to restore access.

Technologies: [phpmyfaq/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq), [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-35676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35676 being exploited in the wild.

**How severe is CVE-2026-35676?** High severity, with a CVSS score of 8.2, published 28 May 2026.

**Which products and versions are affected?** phpmyfaq/phpmyfaq (Packagist) ECOSYSTEM:introduced=0,fixed=4.1.3; thorsten/phpmyfaq (Packagist) ECOSYSTEM:introduced=0,fixed=4.1.3.

**Is there a fix for CVE-2026-35676?** Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.3 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35676 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-35676?** Check whether you run phpmyfaq/phpmyfaq (Packagist) or thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.3 or later

  ```sh
  composer require phpmyfaq/phpmyfaq:^4.1.3
  ```

- thorsten/phpmyfaq (Packagist): upgrade to 4.1.3 or later

  ```sh
  composer require thorsten/phpmyfaq:^4.1.3
  ```


## Technical details

A vulnerability exists in the `UnauthorizedUserController.php` component of phpMyFAQ due to a weak password recovery mechanism (CWE-640). The API endpoint `/api/index.php/user/password/update` processes PUT requests and immediately updates a user's password in the database if the provided username and email match, without requiring a reset token or out-of-band confirmation. An unauthenticated remote attacker can exploit this to invalidate legitimate user credentials and perform account enumeration based on the server's response (200 OK for success vs 409 Conflict for mismatches). While the new password is sent to the victim's email, the immediate invalidation of the existing password constitutes a denial-of-service against user accounts. This issue is resolved in version 4.1.3.

## Affected products

- thorsten phpMyFAQ < 4.1.3

## Identifiers

- CVE-2026-35676
- GHSA-9qv9-8xv6-5p35

## Timeline

- 2026-05-14: advisory: GitHub Security Advisory published by maintainer
- 2026-05-28: disclosed: CVE published to NVD dataset
- 2026-05-28: patched: Fix confirmed available in version 4.1.3

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9qv9-8xv6-5p35](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9qv9-8xv6-5p35)
- [https://www.vulncheck.com/advisories/phpmyfaq-unauthenticated-password-reset-via-user-password-update-endpoint](https://www.vulncheck.com/advisories/phpmyfaq-unauthenticated-password-reset-via-user-password-update-endpoint)

## Related threats

- [phpMyFAQ SQL injection in StopWords::add()](https://junglewise.ai/threats/cve-2026-56738-phpmyfaq-sql-injection-in-stopwords-add)
- [phpMyFAQ SQL LIKE wildcard injection in chat user search](https://junglewise.ai/threats/cve-2026-47132-phpmyfaq-sql-like-wildcard-injection-in-chat-user-search)
- [phpMyFAQ two-factor authentication password bypass](https://junglewise.ai/threats/cve-2026-56737-phpmyfaq-two-factor-authentication-password-bypass)
- [phpMyFAQ stored XSS in admin FAQ editor via HTML entity bypass](https://junglewise.ai/threats/cve-2026-56736-phpmyfaq-stored-xss-in-admin-faq-editor-via-html-entity-bypass)
- [phpMyFAQ information disclosure of inactive FAQ content in public API](https://junglewise.ai/threats/cve-2026-57994-phpmyfaq-information-disclosure-of-inactive-faq-content-in-public)