CVE-2026-76209 is a missing authorization vulnerability in phpMyFAQ before version 4.1.6. The application fails to validate the security.enableRegistration configuration flag in specific API endpoints, allowing attackers to bypass registration restrictions and create user accounts via unauthenticated POST requests to /api/register or /api/v3.1/register. This occurs because these endpoints do not check the configuration setting that is enforced by the HTML registration page.

Attackers can create user accounts even when registration is disabled, potentially allowing unauthorized access or abuse of the system's user management. The vulnerability does not require user interaction and can be exploited remotely over the network. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints or implement additional access controls to prevent unauthorized registration via the API.