CVE-2026-35672

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28

Configurations

No configuration.

History

26 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) phpMyFAQ anterior a la versión 4.1.3 contiene una vulnerabilidad de omisión de autenticación en la API v4.0 donde el valor predeterminado vacío de api.apiClientToken permite a usuarios no autenticados crear y modificar entradas de FAQ. Los atacantes pueden enviar una cabecera x-pmf-token vacía para omitir la validación del token e inyectar contenido malicioso a través de los endpoints POST /api/v4.0/faq/create, /api/v4.0/category y /api/v4.0/question.

Information

Published : 2026-05-28 16:16

Updated : 2026-10-26 13:10

NVD link : CVE-2026-35672

Mitre link : CVE-2026-35672

CVE.ORG link : CVE-2026-35672

JSON object : View

Products Affected

No product.

CWE

CWE-1188

Initialization of a Resource with an Insecure Default

{"id": "CVE-2026-35672", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35672", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T15:28:03.726415Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "thorsten", "product": "phpMyFAQ", "versions": [{"status": "affected", "version": "0", "lessThan": "4.1.3", "versionType": "semver"}, {"status": "unaffected", "version": "4.1.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-28T16:16:21.667", "references": [{"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question."}, {"lang": "es", "value": "phpMyFAQ anterior a la versi\u00f3n 4.1.3 contiene una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en la API v4.0 donde el valor predeterminado vac\u00edo de api.apiClientToken permite a usuarios no autenticados crear y modificar entradas de FAQ. Los atacantes pueden enviar una cabecera x-pmf-token vac\u00eda para omitir la validaci\u00f3n del token e inyectar contenido malicioso a trav\u00e9s de los endpoints POST /api/v4.0/faq/create, /api/v4.0/category y /api/v4.0/question."}], "lastModified": "2026-10-26T13:10:00.140", "sourceIdentifier": "disclosure@vulncheck.com"}