CVE-2026-35671 describes an insecure direct object reference vulnerability in phpMyFAQ prior to version 4.1.3. The issue exists in the admin API user password endpoint, where insufficient authorization verification permits low-privilege admin users to modify the userId parameter and change passwords of arbitrary users. This enables privilege escalation to SuperAdmin level. The vulnerability is remotely exploitable over the network with low attack complexity and no user interaction required, resulting in high impact on confidentiality, integrity, and availability.

An attacker with low-privilege admin credentials can escalate to SuperAdmin privileges by exploiting this vulnerability. This leads to full administrative control over the phpMyFAQ installation, allowing unauthorized password changes and potentially complete system compromise. The high CVSS score (8.8) reflects the critical nature of the impact on system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official remediation level is provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict admin API access to trusted administrators only and consider additional access controls to limit exposure.