CAPTCHA Bypass Vulnerability in phpMyFAQ Affects Unauthenticated Users
CVE-2026-85586

6.9MEDIUM

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85586?

In versions of phpMyFAQ prior to 4.1.8, a security flaw exists that allows unauthenticated attackers to bypass the CAPTCHA protection mechanism. This vulnerability arises when the store parameter is set to 'now' during question submissions. By exploiting this flaw, attackers can submit an unlimited number of questions, leading to potential database pollution and unwanted triggering of outgoing email notifications.

Affected Version(s)

phpMyFAQ 0 < 4.1.8

phpMyFAQ 4.1.8

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-before-4.1....
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

skeletonsec
.