CVE-2026-85586: phpMyFAQ CAPTCHA Bypass Vulnerability

CVE-2026-85586 Overview

CVE-2026-85586 is a CAPTCHA bypass vulnerability in phpMyFAQ versions before 4.1.8. The flaw resides in the question submission workflow, where the application fails to validate CAPTCHA responses when the store parameter is set to now. Unauthenticated attackers can submit unlimited questions by manipulating this parameter, bypassing the anti-automation control entirely. The vulnerability is classified under CWE-799: Improper Control of Interaction Frequency. Successful exploitation results in database pollution and abuse of the outgoing mail notification system, which administrators receive for each submitted question.

Critical Impact
Unauthenticated attackers can flood phpMyFAQ instances with automated question submissions, polluting the database and triggering mass outbound email notifications to administrators.

Affected Products

phpMyFAQ versions prior to 4.1.8
Deployments exposing the question submission endpoint to unauthenticated users
Instances relying on CAPTCHA as the sole anti-automation defense

Discovery Timeline

2026-09-04 - CVE-2026-85586 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85586

Vulnerability Analysis

phpMyFAQ implements CAPTCHA validation on the public question submission endpoint to prevent automated abuse. The submission handler evaluates the store request parameter to determine the persistence path taken for the incoming question. When store is set to now, the code path skips the CAPTCHA verification routine and proceeds directly to persistence and notification logic. This branching logic exposes a business logic flaw where an attacker-controllable parameter selects whether a security control executes.

Because the endpoint is reachable without authentication, any remote actor can craft submissions that pass through the vulnerable branch. Each accepted submission is written to the FAQ database and triggers an outbound mail notification to configured administrators. At volume, this leads to storage exhaustion, moderation queue saturation, and potential mail server rate limiting or blocklisting.

Root Cause

The root cause is inconsistent enforcement of the CAPTCHA control across submission code paths. The store=now branch was not wired into the same validation pipeline as the standard submission path, resulting in a security control that can be trivially bypassed by toggling a request parameter. This is a classic instance of CWE-799, where the frequency of user interactions is not properly constrained.

Attack Vector

Exploitation requires only network access to the phpMyFAQ instance and knowledge of the submission endpoint. An attacker issues repeated HTTP POST requests to the question submission handler with the store parameter set to now and arbitrary question content. No credentials, user interaction, or elevated privileges are required. The vulnerability is described in the GitHub Security Advisory GHSA-72vj-pvm4-mm7x and the VulnCheck advisory.

Detection Methods for CVE-2026-85586

Indicators of Compromise

Sudden spikes in new question submissions from a small set of source IP addresses.
HTTP POST requests to the phpMyFAQ question submission endpoint containing the parameter store=now.
Large volumes of outbound administrator notification emails referencing new questions.
Newly created FAQ questions with templated, repetitive, or spam-like content.

Detection Strategies

Inspect web server access logs for POST requests to phpMyFAQ submission handlers with store=now in the request body or query string.
Baseline normal question submission rates and alert on statistical deviations from expected volume.
Correlate outbound SMTP notification volume with inbound submission traffic to detect amplification patterns.

Monitoring Recommendations

Enable verbose logging on the phpMyFAQ front controller and forward events to a centralized log platform.
Monitor mail queue depth on servers hosting phpMyFAQ notifications for sustained growth.
Track database row counts on the questions table and alert on abnormal insertion rates.

How to Mitigate CVE-2026-85586

Immediate Actions Required

Upgrade phpMyFAQ to version 4.1.8 or later, which enforces CAPTCHA validation on all submission code paths.
Audit the questions table for spam entries created prior to patching and purge illegitimate records.
Review outbound mail logs and notify administrators whose inboxes may have been flooded.

Patch Information

The upstream fix is delivered in phpMyFAQ 4.1.8. Refer to the GitHub Security Advisory GHSA-72vj-pvm4-mm7x for the patched commit and release notes. Administrators running self-hosted deployments should update immediately and verify the installed version through the admin console.

Workarounds

Restrict access to the question submission endpoint using a reverse proxy or web application firewall rule that blocks requests containing store=now until the patch is applied.
Apply rate limiting per source IP address on the submission endpoint to reduce the impact of automated abuse.
Temporarily disable public question submission if patching cannot be performed within an acceptable window.

bash

# Example nginx rule to block the vulnerable parameter value pre-patch
location /index.php {
    if ($request_method = POST) {
        if ($request_body ~* "store=now") { return 403; }
    }
    limit_req zone=faq_submit burst=5 nodelay;
}