CVE-2026-35676 describes an unauthenticated password reset vulnerability in phpMyFAQ before version 4.1.3. The issue exists in the user password update API endpoint, which does not require token validation to change passwords. Attackers can enumerate valid username and email pairs and send PUT requests to the /api/index.php/user/password/update endpoint to forcibly change passwords, causing account disruption and denial of access for legitimate users. This vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity due to its network attack vector, low attack complexity, no privileges required, and no user interaction needed.

An attacker can reset any user's password without authentication or token verification, leading to account takeover or denial of service for legitimate users. Confidentiality is partially impacted as attackers can confirm valid usernames and emails. Integrity is highly impacted because attackers can change passwords arbitrarily. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the password update API endpoint and monitor for suspicious PUT requests targeting /api/index.php/user/password/update. Implement additional access controls or temporary mitigations if possible.