CVE-2026-85591

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.8

Description An authentication bypass exists in the user control panel API endpoint. Authenticated attackers with session access can change any user's password, including administrators, without verifying the current password. This is achieved by submitting a PUT request to the user data update endpoint using only a CSRF token, leading to irreversible account takeover and victim lockout.

Recommendations Update to version 4.1.8 or later.