CVE-2026-35672

Published: May 28, 2026

Modified: May 28, 2026

PUBLISHED

CVSS v3.1

7.5

HIGH

Description

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

Vendor	Product	Versions
thorsten	phpMyFAQ	affected `0 - < 4.1.3` unaffected `4.1.3`

Weaknesses (CWE)

CWE-1188

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

References

GHSA Advisory GHSA-gp95-j463-vv28

third-party-advisory

VulnCheck Advisory: phpMyFAQ - Authentication Bypass via Empty API Token

third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2026-35672

Description

Affected Products

Weaknesses (CWE)

CVSS v3.1 Details

References