Compliance Impact

The vulnerability allows unauthenticated attackers to create and modify FAQ entries, which could lead to content injection, phishing, SEO spam, or reputation damage.

Such unauthorized modifications and potential injection of malicious content could compromise data integrity and trustworthiness of the system, potentially violating compliance requirements related to data security and integrity under standards like GDPR and HIPAA.

However, the provided information does not explicitly detail the direct impact on compliance with these regulations.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-35672 is an authentication bypass vulnerability in phpMyFAQ versions before 4.1.3. The issue occurs because the default configuration sets an empty API client token, which allows unauthenticated users to bypass token validation by sending an empty x-pmf-token header.

This flaw exists due to a faulty comparison in the hasValidToken() method, which incorrectly treats an empty token as valid when no token is configured. As a result, attackers can create, modify, or delete FAQ entries, categories, and questions through the REST API without any credentials.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability allows attackers to inject malicious content into the FAQ system by creating or modifying entries, categories, and questions without authentication.

• Content injection
• Phishing attacks
• SEO spam
• Damage to the reputation of the affected site or organization

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your phpMyFAQ installation is running a version before 4.1.3 and if the API client token is set to an empty value. Specifically, you can test if sending an empty x-pmf-token header to the REST API endpoints allows unauthorized access.

A practical detection method is to send HTTP POST requests to the vulnerable API endpoints such as /api/v4.0/faq/create, /api/v4.0/category, or /api/v4.0/question with an empty x-pmf-token header and observe if the request is accepted without authentication.

• Use curl to test the authentication bypass, for example:
• curl -X POST https://your-phpmyfaq-domain/api/v4.0/faq/create -H "x-pmf-token:" -d '{"question":"test","answer":"test"}' -v
• If the server accepts this request and creates or modifies content without requiring a valid token, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade phpMyFAQ to version 4.1.3 or later, where this authentication bypass vulnerability has been patched.

If upgrading immediately is not possible, manually set a non-empty api.apiClientToken value in the configuration to prevent the empty token from being accepted.

Additionally, restrict access to the API endpoints by network controls or firewall rules to limit exposure until the patch is applied.

Useful 0 Not Useful 0