Executive brief
phpMyFAQ is a popular open-source FAQ platform that allows website visitors to submit questions for moderation. A configuration logic flaw allows unauthenticated attackers to bypass the administrator's setting that restricts guest question submissions, enabling them to inject spam and malicious questions directly into the admin moderation queue when the "Ask a Question" feature is enabled.
Technical details
The vulnerability is an incorrect authorization flaw (CWE-863) in the isAddingQuestionsAllowed() method of QuestionController.php. The method contains two independent configuration checks that both grant access without proper precedence: the first checks records.allowQuestionsForGuests, and the second unconditionally returns true if main.enableAskQuestions is enabled, ignoring authentication state. This causes the second check to short-circuit the third check that verifies user permissions, rendering the guest-control setting ineffective. An unauthenticated attacker can send a POST request to the /api/question/create endpoint with arbitrary question data to bypass restrictions. The submitted question is persisted to the database and triggers admin notification emails. The vulnerability is fixed in version 4.1.8.
Affected products
- thorsten phpMyFAQ < 4.1.8
Timeline
- 2026-08-20: disclosed: GitHub Security Advisory GHSA-546h-9ghq-x49g published
- 2026-09-04: advisory: CVE-2026-85592 published on NVD
- 2026: patched: Fixed in version 4.1.8