phpMyFAQ CVE-2026-35671

Exploitation requires the attacker to already hold an authenticated phpMyFAQ admin session with the USER_EDIT permission and a valid CSRF token scoped to the 'overwrite-password' page, and to be able to reach the /admin/api/user/overwrite-password endpoint over the network - these match CVSS PR:L, AV:N, AC:L, AT:N, UI:N. No special non-default configuration, plugin, or platform is required: the vulnerable overwritePassword() controller in UserController.php ships in every phpMyFAQ build before 4.1.3. The principal limiting factor is the PR:L precondition - purely anonymous internet attackers cannot exploit this directly - but in deployments that delegate the 'admin' role to non-trusted staff (a common phpMyFAQ pattern for content editors), the bar is effectively low.

This is a real, high-priority issue for any organization running phpMyFAQ with delegated admin accounts. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H (base 8.7) is internally consistent with the description: network reachable, low complexity, requires a low-privilege admin token, no user interaction, and full confidentiality/integrity/availability impact on the application after takeover of SuperAdmin. EPSS, KEV listing, and SSVC decision data were not provided in the input, so probabilistic exploitation likelihood cannot be quantified, and there is no confirmation of active exploitation. The risk skew here is driven by the precondition (an attacker must already hold an admin-tier account), but in environments where 'admin' is delegated to many staff members or content editors, that bar is low, and the vendor advisory publishes the exact vulnerable file and method, so exploit construction is trivial even without a packaged PoC.

A content-editor-level admin (or an external attacker who has phished or brute-forced any low-tier admin credential) sends an authenticated PUT to /admin/api/user/overwrite-password with a valid CSRF token and a JSON body containing userId=1, newPassword, and passwordRepeat. The server overwrites the SuperAdmin password without checking the target's privilege level, after which the attacker logs in as SuperAdmin and gains full control of the phpMyFAQ instance, its content, and any integrated data sources. No packaged PoC is referenced in the inputs, but the GHSA advisory discloses the exact request shape and vulnerable method, making reproduction straightforward.