CVE-2026-85591: phpMyFAQ Authentication Bypass Vulnerability

CVE-2026-85591 Overview

CVE-2026-85591 is an authentication bypass vulnerability in phpMyFAQ versions before 4.1.8. The flaw resides in the user control panel API endpoint responsible for updating user data. The endpoint accepts password change requests without verifying the current password, requiring only a valid session and CSRF token. An authenticated attacker with session access can silently reset any user's password, including administrator accounts. The result is irreversible account takeover and lockout of the legitimate user. The vulnerability is categorized under [CWE-620: Unverified Password Change].

Critical Impact
Authenticated attackers can hijack any phpMyFAQ account, including administrators, by issuing a single PUT request that changes the password without knowing the current one.

Affected Products

phpMyFAQ versions prior to 4.1.8
phpMyFAQ user control panel API (user data update endpoint)
Deployments exposing authenticated session access to untrusted users

Discovery Timeline

2026-09-04 - CVE-2026-85591 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85591

Vulnerability Analysis

phpMyFAQ exposes a user data update endpoint in the user control panel that accepts PUT requests to modify account attributes, including the password. The endpoint enforces CSRF token validation and session authentication, but omits any check that the caller knows the current password. As a result, a request containing only a valid session cookie, a CSRF token, and a new password value is accepted and applied. The application then rewrites the stored password hash for the target user.

An attacker who compromises or reuses an authenticated session, or who leverages an already-authenticated administrator session through session fixation or theft, can pivot into full account takeover. Because the write occurs server-side and replaces the password hash, the legitimate account owner is locked out with no recovery unless out-of-band reset flows exist. Administrator accounts are the highest-value targets, since capturing them grants full control over the phpMyFAQ instance, its content, and any linked user data.

Root Cause

The root cause is missing verification of the current password on a state-changing password update operation. The endpoint conflates session authentication with authorization for sensitive credential changes. CSRF protection alone does not address this class of flaw, since the attacker holds the session rather than tricking a victim into submitting a request.

Attack Vector

Exploitation requires network access to the phpMyFAQ instance and authenticated session context. The attacker submits a crafted PUT request to the user data update endpoint containing a valid CSRF token and the new password field. No user interaction from the victim is required. Refer to the GitHub Security Advisory GHSA-6r2c-694w-24qv and the VulnCheck Advisory on Authentication Bypass for technical details.

Detection Methods for CVE-2026-85591

Indicators of Compromise

Unexpected PUT requests to the phpMyFAQ user control panel user data update endpoint containing a password field.
Password hash changes in the phpMyFAQ user database that do not correlate with password reset workflow events.
Successful logins to administrator accounts from new IP addresses or user agents immediately following an account update event.
User complaints of sudden lockout or inability to authenticate with known-good credentials.

Detection Strategies

Enable and review phpMyFAQ application and web server access logs for PUT requests to user update endpoints, correlating source session, IP, and target user ID.
Alert when a session associated with one user modifies another user's account, especially administrator accounts.
Monitor database audit trails for updates to the user password hash column outside of documented password reset flows.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for correlation across session identity and account modification events.
Baseline normal password change frequency per user and alert on deviations, particularly bursts of updates from a single session.
Track administrator account authentication patterns and trigger alerts on password hash changes followed by new-source logins.

How to Mitigate CVE-2026-85591

Immediate Actions Required

Upgrade phpMyFAQ to version 4.1.8 or later on all instances.
Force a password reset for all users, prioritizing administrator and privileged accounts, after upgrading.
Invalidate all active sessions to evict any attacker who may hold a stolen session token.
Review user account audit logs for unauthorized password changes since the vulnerable code path was deployed.

Patch Information

The fix is included in phpMyFAQ 4.1.8. The upstream advisory is published at GitHub Security Advisory GHSA-6r2c-694w-24qv. Administrators should apply the release through their standard package or source deployment process and verify the running version after upgrade.

Workarounds

Restrict network access to the phpMyFAQ user control panel to trusted IP ranges until the patch is applied.
Enforce short session lifetimes and require reauthentication for sensitive actions at the reverse proxy or WAF layer.
Temporarily disable self-service account editing for non-administrative users if upgrade cannot be performed immediately.

bash

# Configuration example: verify installed phpMyFAQ version and upgrade
grep -R "VERSION" /var/www/phpmyfaq/config/constants.php
# Expected after remediation: 4.1.8 or later