CVE-2026-85590

phpMyFAQ before 4.1.8 contains a flaw in its two-factor authentication (TOTP) disable functionality: the POST /api/user/remove-twofactor handler (removeTwofactorConfig()) disables TOTP after checking only that the user is logged in and that a valid CSRF token is supplied, without requiring password re-entry or a current TOTP code. The same downgrade is also reachable through PUT /api/user/data/update, which accepts a plain twofactor_enabled field under the same session-plus-CSRF-only guard. An attacker who has already hijacked a user's session (for example via a stolen session cookie) can silently strip two-factor protection from any account, including administrator accounts, and subsequently authenticate with the password alone. Any phpMyFAQ deployment running a version prior to 4.1.8 is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only a 0.4% chance of exploitation in the next 30 days, indicating no confirmed exploitation to date; note that this flaw does not grant initial access by itself, but undermines the 2FA layer once a session is compromised.

What to do: Upgrade to phpMyFAQ 4.1.8 or later, which requires stronger verification when TOTP is disabled. Until patched, keep session lifetimes short, use secure cookies, and revoke sessions when theft is suspected, since this flaw is only exploitable with a hijacked session; audit accounts—especially administrators—for unexpectedly disabled two-factor authentication. Note that EPSS (0.4%) and the absence of a public PoC indicate low immediate risk, but patching restores the integrity of the 2FA control.