CVE-2026-35676 describes a vulnerability in phpMyFAQ prior to version 4.1.3 where the password reset mechanism lacks proper authentication and token validation. This allows unauthenticated attackers to enumerate valid usernames and emails and forcibly reset passwords by sending crafted PUT requests to the password update API endpoint. The vulnerability impacts confidentiality and integrity by enabling unauthorized password changes, causing denial of access for legitimate users. The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity with limited impact on confidentiality and no impact on availability. No patch or official remediation level is currently documented.

The vulnerability allows attackers to reset passwords of user accounts without authentication, leading to account takeover and denial of service for legitimate users. Confidentiality is partially impacted due to username and email enumeration, and integrity is highly impacted due to unauthorized password changes. Availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the password update API endpoint if possible and monitor for suspicious PUT requests targeting /api/index.php/user/password/update. Avoid relying on this password reset mechanism in affected versions. Do not assume the vulnerability is mitigated without vendor confirmation.