---
id: CVE-2026-35676
title: phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint
summary: >-
  phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability
  in the user password update API endpoint that allows attackers to change
  account passwords without token validation. Attackers can enumerate valid
  username an…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-640
vendor: thorsten
product: phpMyFAQ
affected:
  - phpMyFAQ < 4.1.3
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-05-28T15:35:26.991955Z'
exploitAvailable: true
published: '2026-05-28'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:30.610Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-35676'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9qv9-8xv6-5p35
    label: GitHub Security Advisory (GHSA-9qv9-8xv6-5p35)
  - url: >-
      https://www.vulncheck.com/advisories/phpmyfaq-unauthenticated-password-reset-via-user-password-update-endpoint
    label: >-
      VulnCheck Advisory: phpMyFAQ - Unauthenticated Password Reset via User
      Password Update Endpoint
tags:
  - cve.org
  - exploit-available
epss: 0.00302
epssPercentile: 0.2314
ingestedAt: '2026-11-08T14:51:22.449Z'
---

## Overview

phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sending PUT requests to the /api/index.php/user/password/update endpoint, causing account disruption and invalidating legitimate user credentials.

## Affected

- `phpMyFAQ < 4.1.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.