Is CVE-2026-85592 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85592 being exploited in the wild.

How severe is CVE-2026-85592?

Low severity, with a CVSS score of 3.7, published 4 September 2026.

Is there a fix for CVE-2026-85592?

A patch was published on 2026: Fixed in version 4.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85592 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85592?

Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85592: phpMyFAQ authorization bypass in question creation endpoint

CVE-2026-85592 · Severity: low · CVSS 3.7 · Published 2026-09-04

phpMyFAQ is a popular open-source FAQ platform that allows website visitors to submit questions for moderation. A configuration logic flaw allows unauthenticated attackers to bypass the administrator's setting that restricts guest question submissions, enabling them to inject spam and malicious questions directly into the admin moderation queue when the "Ask a Question" feature is enabled.

Technologies: Thorsten phpMyFAQ. Vendors: Thorsten.

Quick answers

Is CVE-2026-85592 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85592 being exploited in the wild.
How severe is CVE-2026-85592?: Low severity, with a CVSS score of 3.7, published 4 September 2026.
Which products and versions are affected?: Thorsten phpMyFAQ < 4.1.8.
Is there a fix for CVE-2026-85592?: A patch was published on 2026: Fixed in version 4.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85592 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85592?: Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incorrect authorization flaw (CWE-863) in the isAddingQuestionsAllowed() method of QuestionController.php. The method contains two independent configuration checks that both grant access without proper precedence: the first checks records.allowQuestionsForGuests, and the second unconditionally returns true if main.enableAskQuestions is enabled, ignoring authentication state. This causes the second check to short-circuit the third check that verifies user permissions, rendering the guest-control setting ineffective. An unauthenticated attacker can send a POST request to the /api/question/create endpoint with arbitrary question data to bypass restrictions. The submitted question is persisted to the database and triggers admin notification emails. The vulnerability is fixed in version 4.1.8.

Affected products

thorsten phpMyFAQ < 4.1.8

Timeline

2026-08-20: disclosed: GitHub Security Advisory GHSA-546h-9ghq-x49g published
2026-09-04: advisory: CVE-2026-85592 published on NVD
2026: patched: Fixed in version 4.1.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.