# CVE-2026-46364: phpMyFAQ SQL injection in BuiltinCaptcha via User-Agent header

Source: https://junglewise.ai/threats/cve-2026-46364-phpmyfaq-sql-injection-in-builtincaptcha-via-user-agent-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-46364 · Severity: critical · CVSS 9.8 · Published 2026-05-15

phpMyFAQ, a popular open-source FAQ software, contains a security flaw that allows anyone on the internet to access or modify its database without a password. By sending a specially crafted web request, an attacker can steal sensitive information like administrator login credentials, email settings, and private FAQ content. This could lead to a total takeover of the FAQ system or the deletion of important data.

Technologies: [phpmyfaq/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq), [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq), [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-46364 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46364 being exploited in the wild.

**How severe is CVE-2026-46364?** Critical severity, with a CVSS score of 9.8, published 15 May 2026.

**Which products and versions are affected?** phpmyfaq/phpmyfaq (Packagist) <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; thorsten/phpmyfaq (Packagist) <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; Thorsten phpMyFAQ < 4.1.2.

**Is there a fix for CVE-2026-46364?** Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46364 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46364?** Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later

  ```sh
  composer require phpmyfaq/phpmyfaq:^4.1.2
  ```

- thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later

  ```sh
  composer require thorsten/phpmyfaq:^4.1.2
  ```


## Technical details

An unauthenticated SQL injection vulnerability exists in phpMyFAQ's BuiltinCaptcha.php. The `garbageCollector()` and `saveCaptcha()` methods use `sprintf()` to interpolate the `User-Agent` HTTP header and client IP address directly into SQL DELETE and INSERT queries without proper escaping or parameterization. These methods are triggered by any GET request to the `/api/captcha` endpoint. An attacker can exploit this to perform time-based blind SQL injection to exfiltrate sensitive data (such as bcrypt password hashes from the `faquser` table) or modify/delete database records. The vulnerability is patched in version 4.1.2.

## Affected products

- thorsten phpMyFAQ <= 4.1.1

## Identifiers

- CVE-2026-46364
- GHSA-289f-fq7w-6q2w

## Timeline

- 2026-04-28: disclosed: Initial disclosure to vendor
- 2026-05-06: advisory: GitHub Advisory published
- 2026-05-06: patched: Fix released in version 4.1.2

## References

- [https://api.github.com/users/adrgs](https://api.github.com/users/adrgs)
- [https://github.com/adrgs](https://github.com/adrgs)
- [https://api.github.com/users/adrgs/gists%7B/gist_id%7D](https://api.github.com/users/adrgs/gists%7B/gist_id%7D)
- [https://api.github.com/users/adrgs/repos](https://api.github.com/users/adrgs/repos)
- [https://avatars.githubusercontent.com/u/11564377?v=4](https://avatars.githubusercontent.com/u/11564377?v=4)
- [https://api.github.com/users/adrgs/events%7B/privacy%7D](https://api.github.com/users/adrgs/events%7B/privacy%7D)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)