CVE-2026-85592

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.8

Description An authorization bypass exists in the question creation process. The isAddingQuestionsAllowed() function grants access to all users when the main.enableAskQuestions setting is active, failing to respect the records.allowQuestionsForGuests configuration. This allows unauthenticated users to submit questions through the 'question/create' API endpoint, bypassing guest restrictions to inject spam into the administrative moderation queue.

Recommendations Update to version 4.1.8 or later. As a temporary mitigation, disable the main.enableAskQuestions setting to prevent unauthorized question submissions.