phpMyFAQ CVE-2026-85590

Exploitation requires that the attacker holds a valid authenticated session for the target phpMyFAQ user account (PR:L) - this session can belong to any account, including a regular user who also has TOTP enabled. The attacker must also supply a valid CSRF token, which is obtainable by issuing any authenticated GET request within the same session. No special server configuration, non-default features, or elevated privileges beyond a valid session are required to invoke the vulnerable endpoints. Exploitation is limited by the prerequisite of session hijacking: an attacker without an active session for the target account cannot exploit this vulnerability directly. The flaw does not bypass login itself - it downgrades a post-login security control. After TOTP is stripped, subsequent authentication to that account requires only the account password, which an attacker may already possess (or can attempt to brute-force or phish independently of this vulnerability).

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H) accurately characterises the core issue: network-reachable, low-complexity execution once a session is held, with high integrity impact (MFA posture is destroyed). The realistic threat model is a two-stage attack: first, the attacker must obtain a valid session cookie - through XSS, session fixation, network interception, or credential theft - and then exploit this flaw to permanently downgrade the account. That prerequisite (PR:L, controlled session) meaningfully constrains exposure; this is not a zero-authentication-required vulnerability. Even a mid-sized municipal IT team in gdynia running phpMyFAQ to publish public FAQs should treat this as urgent if any accounts use TOTP, since administrator compromise is explicitly in scope. No public exploit code and no KEV listing are known at time of analysis, which somewhat reduces the immediacy of opportunistic exploitation, but the simplicity of the HTTP call once a session is held means that any threat actor who reaches that first-stage hurdle faces trivial exploitation of this flaw. The absence of a CVSS Confidentiality impact reflects that the vulnerability itself does not leak data - but the downstream consequence of removing MFA (facilitating subsequent full account takeover) implies a chained integrity and confidentiality risk beyond the raw score.

An attacker who has obtained a victim's session cookie - for example via a stored XSS vulnerability elsewhere in the application or through network-layer session interception - retrieves a valid CSRF token by fetching any authenticated phpMyFAQ page, then issues a single POST to /api/user/remove-twofactor. The server validates only session authenticity and CSRF token, disables TOTP for the account without challenge, and the attacker can subsequently authenticate using the known or brute-forced password alone. No public exploit code is known, but the HTTP call is trivially constructable from the advisory description.