CVE-2026-76209CWE-862broken-access-control

CVE-2026-76209

Medium · published August 19, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST /api/v3.1/register endpoints, which do not check the configuration flag enforced by the HTML registration page.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00289 · 20.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-19T18:17Z
Affected products (1)
ProductVersionsFixed in
phpmyfaq/phpmyfaq< 4.1.64.1.6
References (2)
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h7q4-qgc4-c9vm · [email protected]https://www.vulncheck.com/advisories/phpmyfaq-before-registration-bypass-via-api · [email protected]
EPSS history
Timeline
  • 19 AUG 14:01Z
    phpMyFAQ before v4.1.6 Registration Bypass via API
    cvelistv5