CVE-2026-85586
Received Received - Intake

phpMyFAQ CAPTCHA Bypass via Store Parameter

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85586
EUVD
EUVD-2026-71009

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-799 The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85586 is a vulnerability in phpMyFAQ versions before 4.1.8 where unauthenticated attackers can bypass CAPTCHA protection by setting the 'store' parameter to 'now' in question submission requests. This allows automated spam submissions, leading to database pollution and unnecessary outgoing mail notifications.

Detection Guidance

Check phpMyFAQ logs for repeated question submissions with the 'store=now' parameter. Monitor for unusual spikes in database entries or outgoing mail notifications from the phpMyFAQ system.

Impact Analysis

This vulnerability allows attackers to submit unlimited fake questions, polluting your database with spam. It may also cause your server to send excessive outgoing emails, potentially leading to blacklisting by email providers or abuse complaints.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA due to unauthorized data processing. Unrestricted question submissions may lead to excessive personal data collection without consent, violating GDPR principles. For HIPAA, if the system handles protected health information, the lack of CAPTCHA and CSRF protections could enable unauthorized data entry or spam, compromising data integrity and security.

Mitigation Strategies
  • Upgrade phpMyFAQ to version 4.1.8 or later to address the CAPTCHA bypass issue.
  • Implement rate limiting on question submission endpoints to prevent abuse.
  • Add CSRF token checks to the open-question submission endpoint if not already present.
  • Review and restrict database permissions to minimize pollution from fake submissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart