---
id: CVE-2026-35671
title: phpMyFAQ - Insecure Direct Object Reference in User Password API
summary: >-
  phpMyFAQ before 4.1.3 contains an insecure direct object reference
  vulnerability in the admin API user password endpoint that allows
  authenticated administrators to change any user's password without
  authorization verification. An attack…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-266
vendor: thorsten
product: phpMyFAQ
affected:
  - phpMyFAQ < 4.1.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-05-30T01:55:31.355751Z'
exploitAvailable: true
published: '2026-05-28'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:28.048Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-35671'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-xvp4-phqj-cjr3
    label: GitHub Security Advisory (GHSA-xvp4-phqj-cjr3)
  - url: >-
      https://www.vulncheck.com/advisories/phpmyfaq-insecure-direct-object-reference-in-user-password-api
    label: >-
      VulnCheck Advisory: phpMyFAQ - Insecure Direct Object Reference in User
      Password API
tags:
  - cve.org
  - exploit-available
epss: 0.00384
epssPercentile: 0.32687
ingestedAt: '2026-11-08T14:51:22.450Z'
---

## Overview

phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials can escalate to SuperAdmin by modifying the userId parameter in the overwrite-password API request.

## Affected

- `phpMyFAQ < 4.1.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.