CVE-2026-111892
Deferred Deferred - Pending Action

phpMyFAQ Unauthenticated Email Flooding via Reset Requests

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111892
EUVD
EUVD-2026-103327

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thorsten phpMyFAQ 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects phpMyFAQ versions 4.2.0-alpha up to but not including 4.2.0-beta. It involves missing rate limiting on unauthenticated password reset endpoints, allowing attackers to send unlimited reset requests. This floods a user's inbox with emails and exhausts server and mailer resources, leading to denial-of-service conditions.

Detection Guidance

Check for excessive password reset requests in server logs, particularly for the endpoints /user/password/update and /user/password/reset. Monitor email server logs for a high volume of reset emails sent to a single address.

Impact Analysis

Unauthenticated attackers can exploit this to send unlimited password reset emails to a user, causing mail flooding and resource exhaustion. This may disrupt email services, enable harassment or phishing attempts, and damage the mail server's reputation. Direct account takeover is unlikely due to cryptographic reset tokens.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service conditions through email flooding and resource exhaustion. GDPR requires data protection measures to ensure availability of systems, while HIPAA mandates safeguards against unauthorized access or disruptions. Excessive reset requests may disrupt service availability and could be seen as a failure to implement adequate security controls.

Mitigation Strategies

Apply the latest phpMyFAQ update to version 4.2.0-beta or later. Ensure the UnauthorizedUserController is registered as a dependency injection service with a cache-backed rate limiter. Adjust the global API rate-limiter listener to exclude only truly private routes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111892. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart