CVE-2026-85591
Received Received - Intake

Authentication Bypass in phpMyFAQ User Control Panel API

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data update endpoint with only a CSRF token to silently change any user's password, including administrators, causing irreversible account takeover and victim lockout.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85591
EUVD
EUVD-2026-71014

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-620 When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in phpMyFAQ versions before 4.1.8. It allows authenticated attackers with session access to change any user's password, including administrators, without verifying the current password. Attackers can send a PUT request to the user data update endpoint with just a CSRF token to silently take over accounts and lock out victims.

Detection Guidance

Check phpMyFAQ versions before 4.1.8 by inspecting the software version in use. Monitor API endpoint logs for PUT requests to /api/user/data/update without current password verification. Look for unusual session activity or password change events without user interaction.

Impact Analysis

This vulnerability allows attackers to take over any user account, including administrators, by changing passwords without verification. Victims may be locked out of their accounts, and attackers can gain full control over the system. It requires only session access, which could be obtained through methods like XSS or stolen session cookies.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, which may violate GDPR's data protection requirements for user consent and security. For HIPAA, it could compromise protected health information if phpMyFAQ is used in healthcare contexts, as unauthorized access to accounts may result in breaches of confidentiality.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.8 or later immediately. Implement a patch to require current password verification before password changes. Review and revoke any suspicious active sessions. Enable email notifications for password changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85591. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart