Vulnerability in Thorsten Phpmyfaq
CVE-2026-35676
phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sending PUT requests to the /api/index.php/user/password/update endpoint, causing account disruption and invalidating legitimate user credentials.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (25.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 25.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
- Thorsten Phpmyfaq — versions 0, 4.1.3
Weakness classification (CWE)
References
- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9qv9-8xv6-5p35 (vendor-advisory, third-party-advisory)
- www.vulncheck.com/advisories/phpmyfaq-unauthenticated-password-reset-via-user-p… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-35676?
- CVE-2026-35676 is a high-severity vulnerability in Thorsten Phpmyfaq, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 8.2/10. Published 2026-05-28.
- How severe is CVE-2026-35676?
- High severity. CVSS v3 base score is 8.2 out of 10.