CVE-2026-35672

HighCVSS 7.5

Published: 28/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

32th percentile - higher than 32% of all known CVEs

Summary

phpMyFAQ before version 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries.

Risk Assessment

Attackers can exploit this vulnerability to inject malicious content, potentially leading to serious data security breaches within the organization.

Recommendation

It is recommended to update phpMyFAQ to version 4.1.3 or later and implement additional authentication mechanisms for the API.

Other vulnerabilities in phpMyFAQ API v4.0

CVE-2026-49205Medium
phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController, allowing unauthorized operations on four API endpoints.

Original NVD description (English source)

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS