Registration Bypass Vulnerability in phpMyFAQ by phpMyFAQ
CVE-2026-76209

5.3MEDIUM

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
19 August 2026

What is CVE-2026-76209?

The registration bypass vulnerability in phpMyFAQ allows unauthorized account creation through API endpoints. Specifically, versions prior to v4.1.6 do not validate the security.enableRegistration setting, enabling attackers to submit unauthorized requests to create user accounts. This occurs via the POST /api/register or POST /api/v3.1/register endpoints, where the configuration flag that restricts registration is ignored, presenting a significant security risk.

Affected Version(s)

phpMyFAQ 0 < 4.1.6

phpMyFAQ 4.1.6

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-before-regi...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kevinnivekkevin
.