Auth bypass in Thorsten Phpmyfaq
CVE-2026-85592
phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers can submit questions via the question/create API endpoint to bypass guest submission restrictions and inject spam into the admin moderation queue.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (22.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 22.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
Weakness classification (CWE)
References
- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-546h-9ghq-x49g (vendor-advisory)
- www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-authorization-bypass-via-que… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-85592?
- CVE-2026-85592 is a low-severity vulnerability in Thorsten Phpmyfaq, classified under Incorrect Authorization. CVSS score: 3.7/10. Published 2026-09-04.
- How severe is CVE-2026-85592?
- Low severity. CVSS v3 base score is 3.7 out of 10.