CVE-2026-85586
phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 4, 2026
- Updated
- Sep 10, 2026
- Reserved
- Sep 4, 2026
Description
phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-799 Improper Control of Interaction Frequency
Affected Products
| Product | Versions |
|---|---|
phpMyFAQthorsten |
|
References
- GitHub Security Advisory (GHSA-72vj-pvm4-mm7x)vendor-advisory
- VulnCheck Advisory: phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameterthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.