Vulnerability Description
phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers can submit questions via the question/create API endpoint to bypass guest submission restrictions and inject spam into the admin moderation queue.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-546h-9ghq-x49g
- https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-authorization-bypass-
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-546h-9ghq-x49g
FAQ
What is CVE-2026-85592?
CVE-2026-85592 is a vulnerability with a CVSS score of 3.7 (LOW). phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuest...
How severe is CVE-2026-85592?
CVE-2026-85592 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85592?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.