CVE-2026-75918
HighCVSS 8.8Summary
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.
Risk Assessment
Risk of user account takeover through theft of password reset tokens, potentially leading to unauthorized data access.
Recommendation
Update phpMyFAQ to version 4.1.7 or later. Disable user tracking if not essential, and ensure tracking files are not publicly accessible.
Original NVD description (English source)
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.