CVE-2026-35671: phpMyFAQ - Insecure Direct Object Reference in User Password API

Synopsis

An insecure direct object reference (IDOR) vulnerability exists in the admin API password endpoint of phpMyFAQ before version 4.1.3. The flaw is reachable over the network by any authenticated low-privilege admin account, requiring no additional interaction from a victim. Successful exploitation lets an attacker overwrite any user's password, including the SuperAdmin account, giving full control over the application. A patched-image rebuild at version 4.1.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API endpoint is exposed over the network, so the attacker must be able to reach the service remotely.

• AuthenticationRequired

  A low-privilege admin account is sufficient; no elevated or administrative privileges beyond basic admin access are needed to trigger the vulnerability.

• Victim interactionNot required

  The attacker sends a crafted API request directly; no action from another user or victim is needed.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; the attacker only needs to manipulate the userId parameter in the overwrite-password API request with no race conditions or environmental dependencies.

Blast Radius

• Attacker overwrites the SuperAdmin account password, gaining full administrative control of the phpMyFAQ application.
• Attacker can read, modify, or delete any FAQ content, user data, and application configuration stored in the system.
• All other user accounts become vulnerable to password reset, allowing the attacker to impersonate or lock out any user.
• Full compromise of the phpMyFAQ instance can serve as a pivot point to any backend systems or databases the application connects to.