CVE-2026-35672 | THREATINT

Description

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

PUBLISHED Reserved 2026-04-04 | Published 2026-05-28 | Updated 2026-05-28 | Assigner VulnCheck

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Problem types

Initialization of a Resource with an Insecure Default

Product status

Default status

unaffected

Any version before 4.1.3

affected

4.1.3 (semver)

unaffected

Credits

guayu-kakeru reporter

References

github.com/...pMyFAQ/security/advisories/GHSA-gp95-j463-vv28 exploit

github.com/...pMyFAQ/security/advisories/GHSA-gp95-j463-vv28 (GHSA Advisory GHSA-gp95-j463-vv28) third-party-advisory

www.vulncheck.com/...thentication-bypass-via-empty-api-token (VulnCheck Advisory: phpMyFAQ - Authentication Bypass via Empty API Token) third-party-advisory

cve.org (CVE-2026-35672)

nvd.nist.gov (CVE-2026-35672)

Download JSON