CVE-2026-85592
Received Received - Intake

Authorization Bypass in phpMyFAQ via Question Creation API

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers can submit questions via the question/create API endpoint to bypass guest submission restrictions and inject spam into the admin moderation queue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85592
EUVD
EUVD-2026-71015

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.8 (exc)
phpmyfaq phpmyfaq 4.0.0-alpha.2
phpmyfaq phpmyfaq 4.1.7
phpmyfaq phpmyfaq 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in phpMyFAQ versions before 4.1.8. It allows unauthenticated users to submit questions via the question/create API endpoint even when guest submissions are disabled. The issue occurs because the isAddingQuestionsAllowed() method grants access to all users when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting.

Detection Guidance

Check phpMyFAQ logs for unauthorized question submissions via the question/create API endpoint. Monitor for unusual activity in the admin moderation queue. Verify if the isAddingQuestionsAllowed() method grants access when main.enableAskQuestions is enabled but records.allowQuestionsForGuests is disabled.

Impact Analysis

Unauthenticated attackers can inject spam questions into the admin moderation queue, causing unwanted notifications and administrative overhead. While they cannot read, modify, or delete existing data, the spam may require manual review by administrators. This could lead to operational disruptions and increased workload for moderators.

Compliance Impact

This vulnerability allows unauthenticated users to submit questions bypassing guest restrictions, potentially causing spam or unwanted notifications. While it does not directly expose or modify sensitive data, it could lead to compliance issues by enabling unauthorized content injection into moderation queues, which may violate data integrity or access control requirements in standards like GDPR or HIPAA.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.8 or later to apply the patch. If upgrading is not immediately possible, disable the main.enableAskQuestions feature or set records.allowQuestionsForGuests to false to restrict question submissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85592. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart