Skip to main content

phpMyFAQ CVE-2026-76208

| EUVDEUVD-2026-62449 HIGH
Insufficient Logging (CWE-778)
2026-08-19 VulnCheck GHSA-x7f8-q53c-52pw
Authentication Bypass Phpmyfaq
8.8
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.9 MEDIUM

LDAP must be explicitly configured (AC:H) and attacker must hold LDAP credentials (PR:L); no availability impact applies.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 19, 2026 - 14:56 vuln.today
CVE Published
Aug 19, 2026 - 14:01 cve.org
HIGH 8.8

DescriptionCVE.org

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus('active') unconditionally, which overwrites the account_status column of a pre-existing local account from 'blocked' to 'active'. As a result, a user whose local phpMyFAQ account has been administratively blocked can restore their account and log in by authenticating via LDAP. The state transition is not logged, so administrators cannot detect that the block was overridden. Fixed in 4.1.7.

AnalysisAI

LDAP authentication bypass in phpMyFAQ 3.1.0-4.1.6 allows a blocked local account to be silently reactivated by authenticating via LDAP, letting previously suspended users regain full application access. The AuthLdap::create() method calls User::setStatus('active') unconditionally after any successful LDAP bind, overwriting an administratively set 'blocked' status in the database without logging the state change. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Attacker retains valid LDAP credentials post-blocking
Delivery
Submit LDAP login request to phpMyFAQ portal
Exploit
Server performs successful LDAP directory bind
Execution
AuthLdap::create() calls setStatus('active') unconditionally
Persist
Blocked account_status overwritten in database
Impact
Attacker gains full application access with no audit log entry
Sign in to reveal

Vulnerability AssessmentAI

Exploitation LDAP authentication must be explicitly enabled in phpMyFAQ's configuration - default installations using only local authentication are completely unaffected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N) reflects network exploitability and high integrity impact, but the PR:N and AT:N assignments overstate real-world ease of exploitation - the vulnerability requires LDAP to be explicitly configured and the attacker to hold valid LDAP credentials, conditions not captured in those metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A dismissed employee's phpMyFAQ account has been set to 'blocked' by an administrator, but their Active Directory credentials remain active pending full offboarding. The former employee navigates to the phpMyFAQ login page, submits their LDAP credentials, and the AuthLdap::create() method completes a successful LDAP bind, then unconditionally calls User::setStatus('active'), clearing the block in the database. …
Remediation Upgrade phpMyFAQ to version 4.1.7, the vendor-confirmed fixed release per GitHub security advisory GHSA-8pr3-q3cw-q234. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running phpMyFAQ versions 3.1.0 through 4.1.6 and audit LDAP-authenticated user accounts for recent suspicious login activity, particularly from previously blocked or suspended users. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Phpmyfaq

View all
CVE-2023-5865 CRITICAL POC
9.8 Oct 31

Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
CVE-2023-1886 CRITICAL POC
9.8 Apr 05

Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity

CVE-2023-1753 CRITICAL POC
9.8 Mar 31

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
CVE-2022-3754 CRITICAL POC
9.8 Oct 29

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
CVE-2026-46364 CRITICAL POC
9.3 May 15

Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
CVE-2017-15730 HIGH POC
8.8 Oct 22

In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
CVE-2017-15808 HIGH POC
8.8 Oct 23

In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is

CVE-2017-15735 HIGH POC
8.8 Oct 22

In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
CVE-2017-15734 HIGH POC
8.8 Oct 22

In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
CVE-2024-28107 HIGH POC
8.8 Mar 25

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
CVE-2024-27299 HIGH POC
8.8 Mar 25

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
CVE-2023-1762 HIGH POC
8.8 Mar 31

Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated high severity (CVSS 8.8), th

Same weakness CWE-778 – Insufficient Logging

View all
CVE-2024-48967 CRITICAL
10.0
CVE-2023-1995 HIGH
7.5
CVE-2022-30305 HIGH
7.5
CVE-2019-7613 HIGH
7.5
CVE-2025-52644 MEDIUM
5.8
CVE-2025-2562 MEDIUM
5.4
CVE-2025-62307 MEDIUM
5.4
CVE-2025-53498 MEDIUM
5.3

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-76208 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy