CVE-2026-85591

phpMyFAQ versions before 4.1.8 contain an unverified password-change flaw (CWE-620) in the user control panel API, where password changes are accepted without confirming the user's current password. An attacker with access to an authenticated session can send a PUT request to the user data update endpoint carrying only a valid CSRF token and set a new password without ever supplying the current one. This lets the attacker silently change any user's password, including administrator accounts, resulting in account takeover and irreversibly locking the legitimate user out. All self-hosted phpMyFAQ deployments running versions prior to 4.1.8 are affected. No public proof of concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known; EPSS estimates roughly a 0.3% probability of exploitation within 30 days (22nd percentile).

What to do: Upgrade phpMyFAQ to version 4.1.8 or later. Until patched, review audit logs and user accounts for unexpected password changes (especially administrator accounts) and restrict access to the user control panel API; any accounts that were silently modified or locked out will need their passwords reset. Administrators should verify their installed version first to determine actual exposure.