CVE-2026-76208

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass in AuthLdap::create(): when LDAP authentication is enabled, a successful LDAP bind triggers an unconditional User::setStatus('active') call that overwrites the account_status field of any pre-existing local account. As a result, a user whose local phpMyFAQ account was administratively set to 'blocked' can regain access simply by authenticating through LDAP, silently overriding the administrator's block; the associated CWE-778 reflects that this state transition is not logged, so administrators cannot detect the override. Impact is a violation of access-control integrity (CVSS 4.0: 8.8 High, network vector, no privileges or user interaction required) rather than data theft. Only phpMyFAQ deployments running 3.1.0–4.1.6 with LDAP authentication enabled and locally blocked accounts are affected. A public security advisory (GHSA-8pr3-q3cw-q234) documents the flaw; there is no confirmed in-the-wild exploitation, it is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade to phpMyFAQ 4.1.7 or later. Until patched, if LDAP authentication is enabled, review local accounts with status 'blocked' — their users may have silently reactivated them by logging in via LDAP — and re-block any that were unexpectedly restored, keeping in mind that affected versions leave no log trail of this transition. Where feasible, temporarily restrict or disable LDAP authentication as an interim mitigation.