CVE-2026-76209

phpMyFAQ versions before v4.1.6 contain a missing-authorization flaw (CWE-862) in which the REST API does not check the security.enableRegistration configuration flag. An attacker can bypass the disabled-registration restriction by submitting account-creation requests to POST /api/register or POST /api/v3.1/register, endpoints that skip the check enforced by the HTML registration page. This allows unauthorized creation of user accounts on phpMyFAQ instances where self-registration was deliberately turned off, undermining access controls set by administrators (CVSS 4.0: 5.3, with low integrity impact). Any self-hosted phpMyFAQ deployment running a version prior to 4.1.6 and with registration disabled is affected. There is no evidence of in-the-wild exploitation so far: the flaw is not in CISA KEV, EPSS is about 0.2% over 30 days, and only a public vendor advisory reference is available.

What to do: Upgrade phpMyFAQ to v4.1.6 or later, which enforces the security.enableRegistration check on the API endpoints. As an interim mitigation, block or restrict POST requests to /api/register and /api/v3.1/register (e.g., via reverse-proxy or WAF rules) and audit the user table for accounts created through the API while registration was disabled.