CVE-2026-76208 Overview
CVE-2026-76208 is an authentication bypass vulnerability in phpMyFAQ, an open-source FAQ management application. The flaw resides in the AuthLdap::create() method across versions 3.1.0 through 4.1.6. When Lightweight Directory Access Protocol (LDAP) authentication is enabled, a successful LDAP bind causes the application to unconditionally call User::setStatus('active'). This action overwrites the account_status column of any pre-existing local account, transitioning it from blocked to active. Attackers whose local accounts were administratively disabled can restore access simply by authenticating through LDAP. The vulnerability is fixed in version 4.1.7.
Critical Impact
A blocked phpMyFAQ user can silently reactivate their own account by logging in via LDAP, bypassing administrative controls with no audit trail.
Affected Products
- phpMyFAQ 3.1.0 through 4.1.6 (LDAP authentication enabled)
- Fixed in phpMyFAQ 4.1.7
- Deployments using hybrid local plus LDAP authentication backends
Discovery Timeline
- 2026-08-19 - CVE-2026-76208 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-76208
Vulnerability Analysis
phpMyFAQ supports multiple authentication backends, including local database accounts and external LDAP directories. Administrators can block a local account by setting the account_status column to blocked, which prevents future logins. The AuthLdap::create() routine is invoked when a user authenticates through LDAP for the first time, or when synchronizing an existing user record. After the LDAP server accepts the bind, AuthLdap::create() calls User::setStatus('active') on the matching local account without first checking the current status. This overwrites the administrative block and re-enables the account. The classification aligns with CWE-778: Insufficient Logging, because the state transition is not recorded in any audit log.
Root Cause
The root cause is missing state validation combined with missing audit logging. AuthLdap::create() treats every successful bind as a signal to activate the local account, rather than reconciling the LDAP authentication result with the local account's administrative status. Blocked accounts should either reject LDAP-authenticated logins or require an administrator to lift the block.
Attack Vector
Exploitation requires that the target phpMyFAQ instance has LDAP authentication configured, and that the attacker retains valid LDAP credentials matching a blocked local username. The attacker submits credentials at the standard phpMyFAQ login endpoint. The LDAP bind succeeds, AuthLdap::create() flips account_status to active, and the session is established. No exploitation code is required beyond a normal browser login. Verified proof-of-concept code is not publicly available; refer to the GitHub Security Advisory and VulnCheck Advisory for maintainer technical details.
Detection Methods for CVE-2026-76208
Indicators of Compromise
- Local phpMyFAQ accounts whose account_status changed from blocked to active without a corresponding administrator action ticket
- Successful login sessions for user identifiers that appear in administrative block lists
- LDAP bind events in the directory server correlated with reactivated phpMyFAQ accounts
Detection Strategies
- Query the phpMyFAQ database periodically for accounts flagged as previously blocked and compare current status values against a known-good baseline
- Correlate directory server authentication logs with phpMyFAQ web access logs to identify LDAP logins for accounts that should remain disabled
- Alert on any transition of account_status for user records tracked on an administrative watchlist
Monitoring Recommendations
- Ingest phpMyFAQ web server access logs and database audit logs into a centralized SIEM for cross-source correlation
- Track LDAP bind success events for accounts flagged as terminated or suspended within HR or IAM systems
- Enable database-level triggers or change data capture on the faquser table to record every modification to account_status
How to Mitigate CVE-2026-76208
Immediate Actions Required
- Upgrade phpMyFAQ to version 4.1.7 or later on all instances where LDAP authentication is enabled
- Audit the account_status field of every local account and re-block any account that should not be active
- Rotate or disable LDAP credentials belonging to users whose local phpMyFAQ accounts remain in a blocked state
Patch Information
The phpMyFAQ maintainers released version 4.1.7 to remediate this vulnerability. The fix modifies AuthLdap::create() so that a successful LDAP bind no longer unconditionally overwrites the local account_status. Details are available in the GitHub Security Advisory GHSA-8pr3-q3cw-q234.
Workarounds
- Disable the LDAP authentication backend until the upgrade to 4.1.7 is completed
- Remove or disable directory accounts that correspond to blocked phpMyFAQ users, breaking the exploitation prerequisite
- Apply a temporary database trigger that reverts account_status back to blocked for accounts on a maintained deny list
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
