CVE-2026-46359 is an SQL injection vulnerability in phpMyFAQ prior to version 4.1.2, specifically in the CurrentUser::setTokenData method. Authenticated attackers leveraging Azure AD accounts with specially crafted OAuth token claims containing SQL metacharacters can break out of string literals in SQL queries, enabling arbitrary SQL command execution. This vulnerability affects the cloud-hosted phpMyFAQ service maintained by thorsten. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

Successful exploitation allows authenticated attackers to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access, modification, or deletion, thereby compromising confidentiality, integrity, and availability of the system. The vulnerability specifically affects OAuth token processing with Azure AD accounts, which could be leveraged to escalate privileges or manipulate application data.

A patch is available for this vulnerability. Since phpMyFAQ is a cloud-hosted service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory that the service has been updated to version 4.1.2 or later. No additional mitigation steps are indicated beyond applying the official patch or ensuring the cloud service is updated.