CVE-2026-35671
phpMyFAQ - Insecure Direct Object Reference in User Password API
- State
- Published
- Severity
- 8.7 High
- Published
- May 28, 2026
- Updated
- Jun 23, 2026
- Reserved
- Apr 4, 2026
Description
phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials can escalate to SuperAdmin by modifying the userId parameter in the overwrite-password API request.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-266 Incorrect Privilege Assignment
Affected Products
| Product | Versions |
|---|---|
phpMyFAQthorsten |
|
References
- GHSA Advisory GHSA-xvp4-phqj-cjr3vendor-advisory
- VulnCheck Advisory: phpMyFAQ - Insecure Direct Object Reference in User Password APIthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.