CVE-2026-76209
MediumCVSS 4.3Summary
phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST /api/v3.1/register endpoints, which do not check the configuration flag enforced by the HTML registration page.
Risk Assessment
The risk is unauthorized creation of user accounts, which could lead to unauthorized access to the system and potential data security breaches.
Recommendation
It is recommended to immediately upgrade phpMyFAQ to version 4.1.6 or later, which includes a fix for the registration validation in the API.
Original NVD description (English source)
phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST /api/v3.1/register endpoints, which do not check the configuration flag enforced by the HTML registration page.