CVE-2026-85591: Unverified Password Change in thorsten phpMyFAQ
Description
phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data update endpoint with only a CSRF token to silently change any user's password, including administrators, causing irreversible account takeover and victim lockout.
CVSS v4.0
Score 7.1high
Affected software
thorsten
phpMyFAQ
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85591 affects phpMyFAQ versions prior to 4.1.8 and involves an authentication bypass vulnerability in the user control panel API endpoint. Authenticated attackers who have session access can exploit this flaw by sending a PUT request to the user data update endpoint with only a CSRF token, bypassing the need to verify the current password. This allows them to change any user's password, including administrative accounts, resulting in irreversible account takeover and locking out the legitimate user.
Potential Impact
Successful exploitation allows attackers with session access to change passwords of any user account without verifying the current password. This leads to irreversible account takeover and victim lockout, including for administrator accounts. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.1, indicating significant risk to confidentiality and integrity of user accounts.
Mitigation Recommendations
A fix is available in phpMyFAQ version 4.1.8. Users should upgrade to version 4.1.8 or later to remediate this vulnerability. Until patched, restrict session access and monitor for suspicious activity related to password changes. Patch status is confirmed by the affectedVersions field indicating versions before 4.1.8 are vulnerable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-04T10:59:00.162Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9aada1acd9273b4981d9fb
Added to database: 09/04/2026, 11:38:09 UTC
Last enriched: 09/14/2026, 23:59:54 UTC
Last updated: 10/17/2026, 06:48:21 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.