CVE-2026-75918
Received Received - Intake

phpMyFAQ Password Reset Token Exposure via Tracking File

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75918
EUVD
EUVD-2026-62443

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects phpMyFAQ versions before 4.1.7. When user tracking is enabled, the application stores password reset tokens in a publicly accessible file at content/core/data/trackingDDMMYYYY. Attackers can read this file to extract reset tokens and replay them to take over user accounts without authentication.

Detection Guidance

Check for publicly accessible tracking files in the phpMyFAQ web root directory, specifically files matching the pattern content/core/data/tracking*. These files may contain sensitive password reset tokens in the query strings of logged URLs. Use commands like 'find /var/www/html -name "tracking*" -type f' to locate them. Verify if user tracking is enabled in phpMyFAQ's configuration.

Impact Analysis

Unauthenticated attackers can take over any user account, including super-admin accounts, by accessing reset tokens. This allows full account compromise, data manipulation, or unauthorized access to sensitive information stored in phpMyFAQ.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal data. It exposes sensitive information (reset tokens) leading to account takeovers, which could result in data breaches and non-compliance with privacy requirements.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.7 or later immediately. Disable user tracking in phpMyFAQ's configuration if enabled. Restrict file permissions on the tracking directory to prevent public access. Review and revoke any exposed password reset tokens by forcing password resets for all users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75918. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart