CVE-2026-76209
Received Received - Intake

phpMyFAQ Account Creation Bypass via API

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST /api/v3.1/register endpoints, which do not check the configuration flag enforced by the HTML registration page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76209
EUVD
EUVD-2026-62450

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

phpMyFAQ versions before v4.1.6 have a flaw where API endpoints for user registration do not validate the security.enableRegistration setting. This allows attackers to create user accounts even when registration is disabled via the HTML interface by sending requests to POST /api/register or POST /api/v3.1/register.

Detection Guidance

Check for unauthorized POST requests to /api/register or /api/v3.1/register endpoints in your web server logs. Monitor for unexpected user account creations when registration is disabled in phpMyFAQ settings.

Impact Analysis

Attackers could exploit this to create unauthorized user accounts, potentially leading to spam, unauthorized access, or abuse of application features. If spam protection is disabled, new accounts may be activated automatically.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized user account creation. Unauthorized accounts may lead to unauthorized data access or processing, which conflicts with GDPR's data protection principles and HIPAA's access control requirements. The lack of proper registration validation in API endpoints may result in non-compliance with security controls mandated by these regulations.

Mitigation Strategies
  • Upgrade phpMyFAQ to version 4.1.6 or later to patch the vulnerability.
  • Add the security.enableRegistration check to both /api/register and /api/v3.1/register API controllers.
  • Review and remove any unauthorized accounts created during the vulnerability window.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76209. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart