Authentication Bypass Vulnerability in phpMyFAQ by phpMyFAQ Team
CVE-2026-76208

8.8HIGH

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
19 August 2026

What is CVE-2026-76208?

The phpMyFAQ application versions 3.1.0 through 4.1.6 are susceptible to an authentication bypass flaw due to improper handling of LDAP authentication. When LDAP authentication is active and a user successfully binds, the system incorrectly changes the status of a locally blocked account to 'active' without appropriate logging. This allows previously blocked users to regain access unnoticed, posing significant security risks to administrators. This vulnerability was addressed in version 4.1.7.

Affected Version(s)

phpMyFAQ 0

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-through-aut...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

pavelkohout396
.