CVE-2026-85592: phpMyFAQ Authorization Bypass Vulnerability

CVE-2026-85592 Overview

CVE-2026-85592 is an authorization bypass vulnerability in phpMyFAQ versions prior to 4.1.8. The flaw resides in the isAddingQuestionsAllowed() method, which grants access to all callers whenever main.enableAskQuestions is enabled. The check ignores the records.allowQuestionsForGuests setting entirely. Unauthenticated attackers can submit questions through the question/create API endpoint, bypassing guest submission restrictions. Successful exploitation allows adversaries to inject spam entries into the administrative moderation queue, degrading operational trust in the FAQ workflow. The issue is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Unauthenticated attackers can bypass guest-question restrictions and flood the admin moderation queue with arbitrary submissions via the question/create API endpoint.

Affected Products

phpMyFAQ versions prior to 4.1.8
Installations with main.enableAskQuestions enabled
Deployments relying on records.allowQuestionsForGuests to restrict submissions

Discovery Timeline

2026-09-04 - CVE-2026-85592 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85592

Vulnerability Analysis

phpMyFAQ exposes a REST-style endpoint at question/create that allows users to submit questions for administrator review. Access control is governed by the isAddingQuestionsAllowed() method. This method is supposed to combine two configuration flags: main.enableAskQuestions (feature toggle) and records.allowQuestionsForGuests (guest permission gate).

The implementation only evaluates the first flag. Once main.enableAskQuestions is enabled, the method returns a permissive result for every caller, regardless of authentication state. Guest submission enforcement is silently disabled. Attackers do not need credentials, tokens, or CSRF context to invoke the endpoint successfully.

While the vulnerability does not expose sensitive data or grant code execution, it undermines the moderation model. Automated abuse can populate the admin queue with malicious or misleading content, potentially seeding downstream phishing or social-engineering payloads if moderators approve submissions without scrutiny.

Root Cause

The root cause is an incorrect authorization check in isAddingQuestionsAllowed(). The function evaluates only the global feature flag and omits the per-role guest permission check, producing an authorization decision that does not match the configured policy. This aligns with the CWE-863 pattern of authorization logic that fails to enforce all applicable constraints.

Attack Vector

The attack is remote and network-based. An unauthenticated attacker sends an HTTP POST request to the question/create API endpoint on a vulnerable phpMyFAQ instance where main.enableAskQuestions is enabled and records.allowQuestionsForGuests is disabled. The endpoint accepts the submission and enqueues the entry for moderation. Refer to the GitHub Security Advisory GHSA-546h-9ghq-x49g and the Vulncheck PHPMyFAQ Advisory for additional technical detail.

// No verified proof-of-concept code is available.
// Vulnerability mechanism described in prose above.

Detection Methods for CVE-2026-85592

Indicators of Compromise

Unusual volume of new entries in the phpMyFAQ administrator moderation queue, especially from unauthenticated sessions.
HTTP POST requests to the question/create API endpoint from unknown or geographically anomalous IP addresses.
Moderation queue entries containing spam keywords, promotional URLs, or automated-submission patterns.

Detection Strategies

Review web server access logs for repeated POST requests targeting question/create without a valid authenticated session cookie.
Correlate application logs with the configured value of records.allowQuestionsForGuests to identify guest submissions that should have been rejected.
Compare inbound request rates to the endpoint against historical baselines to surface sudden spikes indicative of automated abuse.

Monitoring Recommendations

Enable verbose logging on the phpMyFAQ API layer to capture caller identity, source IP, and User-Agent for each question submission.
Configure alerts when the moderation queue depth exceeds a defined threshold within a short time window.
Forward web application logs to a centralized analytics platform for retention, correlation, and anomaly detection.

How to Mitigate CVE-2026-85592

Immediate Actions Required

Upgrade phpMyFAQ to version 4.1.8 or later, which corrects the isAddingQuestionsAllowed() authorization check.
Audit the administrative moderation queue and purge submissions received while running a vulnerable version.
Temporarily disable main.enableAskQuestions if patching cannot be performed immediately.

Patch Information

The upstream fix is included in phpMyFAQ 4.1.8. Administrators should follow the guidance in the GitHub Security Advisory GHSA-546h-9ghq-x49g to apply the update and verify that the corrected authorization logic honors the records.allowQuestionsForGuests setting.

Workarounds

Disable the ask-questions feature by setting main.enableAskQuestions to false in the phpMyFAQ configuration.
Restrict access to the question/create API endpoint at the reverse proxy or web application firewall (WAF) layer, allowing only authenticated sessions.
Apply IP allow-listing or rate limiting to the endpoint to reduce automated abuse until the patch is deployed.

bash

# Example nginx block to restrict the question/create endpoint
location ~* /api/.*/question/create$ {
    limit_req zone=faq_api burst=5 nodelay;
    allow 10.0.0.0/8;
    deny all;
}