CVE-2026-35672: phpMyFAQ - Authentication Bypass via Empty API Token

Synopsis

Authentication bypass in phpMyFAQ before version 4.1.3 allows unauthenticated remote attackers to create and modify FAQ entries through the API. The vulnerability exists because the default empty api.apiClientToken value is never validated, so sending a blank x-pmf-token header passes the authentication check. Successful exploitation lets an attacker inject arbitrary content into FAQ entries, categories, and questions without any credentials. A patched-image rebuild at version 4.1.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the phpMyFAQ API service over the network; no prior foothold on the host is required.

• AuthenticationNot required

  No credentials are needed; sending an empty x-pmf-token header bypasses the token validation check entirely.

• Victim interactionNot required

  The attacker makes direct API requests with no need for a logged-in user to take any action.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required to trigger the bypass.

Blast Radius

• Attacker writes arbitrary content into FAQ entries via the /api/v4.0/faq/create endpoint, enabling persistent content injection visible to all site visitors.
• Attacker creates or modifies categories via /api/v4.0/category, restructuring the FAQ knowledge base without authorization.
• Attacker submits questions via /api/v4.0/question, potentially poisoning the question queue with malicious or misleading content.
• Any injected content persists in the database until manually removed, meaning impact extends beyond the initial request.