phpMyFAQ: Account takeover via e-mail change without current password
Summary
phpMyFAQ does not require the current password when a user changes the account e-mail address in the user control panel. An attacker with a hijacked session can set their own e-mail address and then use the anonymous password-reset flow to receive the reset link and set a new password. Accounts without 2FA, including superadmin accounts, can be fully taken over; accounts with 2FA remain protected only by the TOTP gate.
Affected
- phpMyFAQ before 4.1.9
- phpMyFAQ 4.2.0-alpha before 4.2.0-beta
Fixed in
- Upgrade to phpMyFAQ 4.1.9 or later
- Upgrade to phpMyFAQ 4.2.0-beta or later
Workaround
- Unknown. No vendor workaround found; upgrading is the documented fix.
- Interim measure (not vendor guidance): enforce 2FA for all admin and privileged accounts.
Exploitation
- CISA SSVC: exploitation status poc, not automatable.
- No confirmed public proof of concept or known exploitation found in the sources reviewed.
- Not listed in CISA KEV according to a third-party tracker; verify against the CISA catalog.
- Attacker requires an authenticated low-privilege session, obtained for example via XSS or stolen cookies.
Our recommendation
- Upgrade to phpMyFAQ 4.1.9 or 4.2.0-beta in a maintenance window.
- Check user records for unexpected e-mail addresses, especially for admin accounts, and review recent password-reset activity.
- Enforce 2FA for admin and privileged accounts.
- Restrict admin panel access by IP or VPN where possible.
- After upgrading, log out existing sessions and reset admin passwords if compromise is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7554-gx6g-xx77 github.com
- VulnCheck advisory CVE-2026-111884 www.vulncheck.com
- phpMyFAQ security policy github.com
- phpMyFAQ 4.1 nightly release tag github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:08.
Original description (NVD)
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.