PatchSiren cyber security CVE debrief
CVE-2026-35676 thorsten CVE debrief
phpMyFAQ versions prior to 4.1.3 contain an unauthenticated password reset vulnerability in the user password update API endpoint. The vulnerability allows attackers to change account passwords without token validation by sending PUT requests to /api/index.php/user/password/update. Attackers can enumerate valid username and email pairs to force immediate password changes, resulting in account disruption and invalidation of legitimate user credentials. The vulnerability is classified as CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). The CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and no user interaction needed, with high impact to integrity. The CVE was published on 2026-05-28 and modified later the same day. The vulnerability status in NVD is currently 'Deferred'. No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA KEV.
- Vendor
- thorsten
- Product
- phpMyFAQ
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-28
- Original CVE updated
- 2026-05-28
- Advisory published
- 2026-05-28
- Advisory updated
- 2026-05-28
Who should care
Organizations running phpMyFAQ instances prior to version 4.1.3, particularly those with externally accessible API endpoints. Security teams responsible for web application security and identity management infrastructure. System administrators managing phpMyFAQ deployments in production environments. Incident response teams monitoring for authentication-related attacks and account takeover attempts.
Technical summary
The vulnerability exists in the /api/index.php/user/password/update endpoint which fails to validate authentication tokens before processing password changes. Attackers can exploit this by sending crafted PUT requests containing enumerated username and email pairs. The endpoint accepts password update requests without verifying the requester's identity through session tokens, JWT, or other authentication mechanisms. This allows arbitrary password modification for any valid user account, effectively enabling account takeover without prior authentication. The vulnerability is particularly severe as it requires no privileges and no user interaction, making it trivially exploitable via automated tools.
Defensive priority
HIGH
Recommended defensive actions
- Upgrade to phpMyFAQ 4.1.3 or later to remediate the unauthenticated password reset vulnerability
- Implement network-level access controls to restrict API endpoint exposure if immediate patching is not feasible
- Monitor authentication logs for anomalous password change activities, particularly PUT requests to user password endpoints
- Review and strengthen password reset workflows to ensure proper token validation mechanisms are enforced
- Consider implementing rate limiting on authentication-related API endpoints to reduce enumeration risk
Evidence notes
Vulnerability identified in phpMyFAQ before 4.1.3. Advisory published by Vulncheck and disclosed to GitHub Security Advisories. NVD status marked as 'Deferred' as of 2026-05-28.
Official resources
2026-05-28