Which versions of phpMyFAQ are affected by CVE-2026-35672?

phpMyFAQ installations running versions prior to 4.1.3 are vulnerable to unauthenticated remote modification of FAQ content through an API token validation bypass affecting default configurations.. A patch is available.

How to fix or mitigate CVE-2026-35672?

Within 24 hours: inventory all phpMyFAQ deployments and identify versions < 4.1.3; restrict network access to REST API v4.0 endpoints via firewall or reverse proxy. Within 7 days: evaluate upgrading to phpMyFAQ 4.1.3 or later; if upgrade is not feasible, deploy WAF rules to block requests with empty x-pmf-token headers, or disable the REST API v4.0 entirely if not operationally required. Within 30 days: confirm all instances are upgraded or mitigated; conduct comprehensive API log review for unauthorized modification activity; document all control implementations.

phpMyFAQ CVE-2026-35672

Q: What is the CVSS score of CVE-2026-35672?

CVE-2026-35672 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-32903 HIGH

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-05-28 VulnCheck

GHSA-gp95-j463-vv28

Authentication Bypass Phpmyfaq

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 28, 2026 - 17:01 EUVD

Analysis Updated

May 28, 2026 - 16:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 28, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 28, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Source Code Evidence Fetched

May 28, 2026 - 15:53 vuln.today

Analysis Generated

May 28, 2026 - 15:53 vuln.today

DescriptionCVE.org

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

AnalysisAI

Authentication bypass in phpMyFAQ versions prior to 4.1.3 lets remote unauthenticated attackers create and modify FAQ entries, categories, and questions through the REST API v4.0 by submitting an empty x-pmf-token header that matches the default empty api.apiClientToken value. The flaw stems from strict string comparison logic that cannot distinguish an unconfigured token from an attacker-supplied empty one, exposing every default installation. No public exploit identified at time of analysis, but the GHSA advisory includes a detailed proof-of-concept walkthrough.

Technical ContextAI

phpMyFAQ is a widely deployed open-source PHP FAQ management system (CPE cpe:2.3:a:thorsten:phpmyfaq) maintained by Thorsten Rinne. The defect maps to CWE-1188 (Insecure Default Initialization of a Resource): the installer's DefaultDataSeeder.php seeds the api.apiClientToken configuration value with an empty string, and AbstractController::hasValidToken() uses a strict ! comparison against the inbound x-pmf-token HTTP header. Because '' ! '' evaluates false, the default empty token both satisfies the comparison and bypasses the only authentication guard protecting POST /api/v4.0/faq/create, PUT /api/v4.0/faq/update, POST /api/v4.0/category, and POST /api/v4.0/question - endpoints the OpenAPI annotations explicitly mark as authenticated.

RemediationAI

Vendor-released patch: upgrade phpMyFAQ to 4.1.3 or later, which corrects the seeded default and the comparison logic per the GHSA-gp95-j463-vv28 advisory (https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28). If immediate upgrade is not possible, set api.apiClientToken to a long random secret in the admin configuration so the strict comparison no longer accepts an empty header - this is the lowest-impact workaround and breaks only existing API clients that were relying on the (insecure) empty token. Alternatively, block POST /api/v4.0/faq/create, PUT /api/v4.0/faq/update, POST /api/v4.0/category, and POST /api/v4.0/question at the reverse proxy or WAF, or disable the REST API entirely by setting api.enableAccess to false; both options disable legitimate API-driven content management until reverted.