Insufficient Rate Limiting in phpMyFAQ Affects User Password Reset Functionality
CVE-2026-111892

6.9MEDIUM

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111892?

phpMyFAQ versions prior to 4.2.0-beta suffer from a lack of adequate rate limiting on critical password reset endpoints. This vulnerability allows unauthenticated attackers to target registered users by sending an unlimited number of password reset requests. Consequently, user inboxes can become inundated with reset emails, leading to potential exhaustion of mailer resources and server overload. Implementing proper rate limiting measures is essential to mitigate such risks and protect user accounts.

Affected Version(s)

phpMyFAQ 4.2.0-alpha < 4.2.0-beta

phpMyFAQ 4.2.0-beta

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nirtem
.