CVE-2026-85592: Incorrect Authorization in thorsten phpMyFAQ

CVE-2026-85592 describes an authorization bypass vulnerability in phpMyFAQ prior to version 4.1.8. The flaw exists in the question creation endpoint where the isAddingQuestionsAllowed() method grants permission to submit questions to all callers if the main.enableAskQuestions setting is enabled, without respecting the records.allowQuestionsForGuests setting. This enables unauthenticated attackers to submit questions via the question/create API endpoint, circumventing guest submission restrictions and allowing spam injection into the admin moderation queue.

Unauthenticated attackers can bypass guest submission restrictions and submit questions via the question/create API endpoint. This could lead to spam injection into the admin moderation queue, potentially increasing administrative overhead and degrading the quality of content managed by phpMyFAQ. There is no indication of direct data compromise or privilege escalation beyond the bypass of guest submission controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the main.enableAskQuestions setting or restricting access to the question creation endpoint to trusted users only to prevent unauthorized question submissions.