CVE-2026-76208

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.1.0 through 4.1.6

Description An authentication bypass exists in the AuthLdap::create() function. When LDAP authentication is enabled, a successful LDAP bind triggers the User::setStatus('active') function unconditionally. This action overwrites the account status column of an existing local account, changing it from 'blocked' to 'active'. Consequently, users with administratively blocked local accounts can restore access and log in via LDAP. This state transition is not recorded in logs, preventing administrators from detecting the override.

Recommendations Update phpMyFAQ to version 4.1.7.