CVE-2026-75918

phpMyFAQ before 4.1.7, when the user tracking feature is enabled, writes password reset tokens into a daily tracking file at content/core/data/trackingDDMMYYYY that is publicly readable over the web. An unauthenticated attacker can request a password reset for a target account, retrieve the freshly issued token from that tracking file, and replay it against the password reset API to set a new password. Successful abuse results in full takeover of the targeted account, including privileged accounts such as administrators, which can lead to compromise of the FAQ installation. All phpMyFAQ deployments running versions prior to 4.1.7 with user tracking enabled are affected; instances with tracking disabled or with the content directory not web-accessible are not exposed to this flaw. Exploitation has not been confirmed in the wild (EPSS is 0.3%, not listed in CISA KEV), but a public vendor security advisory reference exists.

What to do: Upgrade to phpMyFAQ 4.1.7 or later. As interim mitigation, disable user tracking or deny direct web access to the content/core/data/ directory (e.g., via web server rules) so tracking files cannot be fetched. Review daily tracking files for exposed reset tokens and force password resets for any accounts whose resets were issued while the instance was exposed.