CVE-2026-85592 Details
Description
phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers can submit questions via the question/create API endpoint to bypass guest submission restrictions and inject spam into the admin moderation queue.
A vulnerability allowing authorization bypass has been identified in phpMyFAQ versions through 4.1.7. This issue arises in the question creation API endpoint, where the 'isAddingQuestionsAllowed()' method improperly grants access to all users when the 'main.enableAskQuestions' feature is activated. The method disregards the 'records.allowQuestionsForGuests' setting, allowing unauthenticated users to submit questions and bypass guest restrictions. As a result, injected questions are directed to the admin moderation queue, potentially leading to spam issues.
Users can update to phpMyFAQ version 4.1.8 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-546h-9ghq-x49g | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-546h-9ghq-x49g | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-authorization-bypass-via-question-create | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | <= 4.1.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |