---
id: CVE-2026-35672
title: phpMyFAQ - Authentication Bypass via Empty API Token
summary: >-
  phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API
  v4.0 where the default empty api.apiClientToken allows unauthenticated users
  to create and modify FAQ entries. Attackers can send an empty x-pmf-token
  header to…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-1188
vendor: thorsten
product: phpMyFAQ
affected:
  - phpMyFAQ < 4.1.3
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-05-28T15:28:03.726415Z'
exploitAvailable: true
published: '2026-05-28'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:28.948Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-35672'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
    label: GitHub Security Advisory (GHSA-gp95-j463-vv28)
  - url: >-
      https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
    label: 'VulnCheck Advisory: phpMyFAQ - Authentication Bypass via Empty API Token'
tags:
  - cve.org
  - exploit-available
epss: 0.00483
epssPercentile: 0.41896
ingestedAt: '2026-11-08T14:51:22.450Z'
---

## Overview

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

## Affected

- `phpMyFAQ < 4.1.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.