phpMyFAQ CVE-2026-111892

Requires that the target phpMyFAQ instance (4.2.0-alpha before 4.2.0-beta) expose the unauthenticated user/password/reset and user/password/update endpoints - these are reachable without authentication by default, and the vulnerability is the absence of effective rate limiting on them. The attacker must know a valid registered user's email/account to target for the reset flood; impact is bounded to that user's inbox and the server's mailer/resource capacity, with no confidentiality exposure. Limiting factors: only affects the specified alpha/beta build range, requires a configured and reachable mail subsystem, and any external rate limiting (WAF, mail relay throttling, reverse-proxy request limits) in front of the application reduces the practical impact.

This is a resource-exhaustion / email-flooding issue (CWE-307, improper restriction of excessive requests) rather than a high-impact code-execution or data-exposure flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a fully remote, unauthenticated, low-complexity trigger with no user interaction, which legitimately raises the ease-of-abuse. However, the impact is intentionally scoped as VI:L/VA:L with VC:N (no confidentiality loss), so the realistic consequence is nuisance-level mail flooding and mailer/server resource drain against a known registered user, not system compromise. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active exploitation or automation despite the low attack complexity. The headline 6.9 score overstates urgency relative to real-world harm: there is no confidentiality impact and the availability/integrity impact is bounded to mail-subsystem abuse. Treat as a low-to-moderate operational priority - patch in normal cycle unless the instance runs a shared or rate-limited mail relay where abuse could cause broader outages. Note the 'Information Disclosure' tag conflicts with the actual DoS/resource-exhaustion nature of the bug and the VC:N metric.

An unauthenticated attacker who knows or guesses a registered user's email repeatedly submits the user/password/reset endpoint, generating a flood of password-reset emails to the victim and consuming the application's mailer and server resources. No exploit code was provided in the intelligence, and exploitation requires nothing beyond scripted HTTP requests given the AV:N/AC:L/PR:N/UI:N vector.