CVE-2026-46359 is an SQL injection vulnerability in phpMyFAQ prior to version 4.1.2, located in the CurrentUser::setTokenData method. Authenticated attackers leveraging Azure AD accounts with specially crafted OAuth token claims containing SQL metacharacters can break out of string literals and execute arbitrary SQL commands against the database. The vulnerability has a CVSS 3.1 score of 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity. The product is a cloud service, and the vendor manages patching on the server side.

Successful exploitation allows authenticated attackers to execute arbitrary SQL queries, potentially leading to unauthorized data disclosure, data modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the phpMyFAQ database. No known exploits in the wild have been reported yet.

A patch for this vulnerability is available. Since phpMyFAQ is offered as a cloud service, the vendor typically applies patches server-side to mitigate the issue. Users should verify with the vendor advisory that their service instance has been updated to version 4.1.2 or later. No additional user action is required if the vendor confirms remediation.