Executive brief
phpMyFAQ is an open-source FAQ software. A security flaw in its administrative interface allows any user with basic administrative editing permissions to change the password of any other user, including the highest-level SuperAdmin. This could lead to a complete takeover of the FAQ system and its data by a low-privileged administrator.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the `overwritePassword()` method of `UserController.php`. The application validates that the requesting user has the `USER_EDIT` permission but fails to verify if the requester is authorized to modify the specific `userId` provided in the PUT request body. An attacker with low-level administrative access can supply the `userId` of a SuperAdmin (typically ID 1) to reset their password. The vulnerability is reachable via the `/admin/api/user/overwrite-password` endpoint and requires a valid CSRF token, which is accessible to the authenticated attacker. This issue is resolved in version 4.1.3.
Affected products
- thorsten phpMyFAQ < 4.1.3
Timeline
- 2026-05-14: disclosed
- 2026-05-20: advisory
- 2026-05-20: patched: Fixed in version 4.1.3
References
- https://api.github.com/users/cyberHunter127
- https://github.com/cyberHunter127
- https://api.github.com/users/cyberHunter127/gists%7B/gist_id%7D
- https://api.github.com/users/cyberHunter127/repos
- https://avatars.githubusercontent.com/u/48629367?v=4
- https://api.github.com/users/cyberHunter127/events%7B/privacy%7D