CVE-2026-35676: phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint

Synopsis

An authentication bypass in phpMyFAQ's user password update API endpoint allows any unauthenticated attacker to reset account passwords without token validation. The vulnerability is reachable over the network and requires no credentials, only a valid username and email pair obtained through enumeration. Successful exploitation lets an attacker lock legitimate users out of their accounts by overwriting their passwords. A patched-image rebuild at version 4.1.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the phpMyFAQ API endpoint over the network; the vulnerable PUT handler is exposed via standard HTTP.

• AuthenticationNot required

  No account or credentials are needed; the password update endpoint performs no token validation before accepting changes.

• Victim interactionNot required

  The attacker sends a direct API request without any need for a user to click a link or take any action.

• Attack complexityDetail

  Exploitation is reliable and condition-free once a valid username and email pair is enumerated; no race conditions or special environment factors apply.

Blast Radius

• The attacker overwrites the password of any targeted account, locking the legitimate user out immediately.
• Invalidated credentials disrupt user sessions and any automated integrations or API tokens tied to the affected account.
• Account takeover grants the attacker whatever level of access the compromised account held within phpMyFAQ, including access to stored FAQ content and administrative functions if an admin account is targeted.