CVE-2026-35672
phpMyFAQ - Authentication Bypass via Empty API Token
- State
- Published
- Severity
- 8.7 High
- Published
- May 28, 2026
- Updated
- Jun 23, 2026
- Reserved
- Apr 4, 2026
Description
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-1188 Initialization of a Resource with an Insecure Default
Affected Products
| Product | Versions |
|---|---|
phpMyFAQthorsten |
|
References
- GHSA Advisory GHSA-gp95-j463-vv28vendor-advisory
- VulnCheck Advisory: phpMyFAQ - Authentication Bypass via Empty API Tokenthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.