PhpMyFAQ: Eight Vulnerabilities Including Auth Bypass and XSS Disclosed Together
Key findings • Eight vulnerabilities disclosed simultaneously for PhpMyFAQ, ranging from Medium to High severity. • Multiple flaws impact authentication and authorization, allowing bypasses a…
Key findings
- Eight vulnerabilities disclosed simultaneously for PhpMyFAQ, ranging from Medium to High severity.
- Multiple flaws impact authentication and authorization, allowing bypasses and privilege escalation.
- Stored XSS vulnerability (CVE-2026-85593) allows script injection via FAQ editing.
- Plaintext TOTP secrets in exports (CVE-2026-85588) pose a risk to 2FA security.
- Most issues fixed in 4.1.8, with one addressed in 4.2.0-alpha.2; prompt updates are essential.
On September 4, 2026, a batch of eight vulnerabilities was disclosed for PhpMyFAQ, a popular web-based FAQ management system. The vulnerabilities, all disclosed on the same day, span a range of severity levels from Low to High, with several impacting authentication and authorization mechanisms. This coordinated disclosure highlights significant security weaknesses that could allow attackers to bypass login, escalate privileges, or inject malicious scripts.
Several vulnerabilities revolve around authentication and authorization bypass. CVE-2026-85591 and CVE-2026-85590, both rated High severity, allow authenticated attackers to bypass password verification for changing account passwords and to disable two-factor authentication, respectively. Additionally, CVE-2026-85592, a Low severity flaw, permits unauthenticated attackers to submit questions by bypassing authorization checks in the question creation endpoint. CVE-2026-85589, a Medium severity issue, involves missing authorization checks on admin dashboard API endpoints, allowing any authenticated user to access sensitive statistics. CVE-2026-85587, also Medium, permits lesser-privileged editors to view draft and inactive content on admin content pages.
Beyond authentication issues, a stored cross-site scripting (XSS) vulnerability, CVE-2026-85593 (Medium severity), was found in the FaqHelper::convertOldInternalLinks() function. This flaw allows authenticated users with FAQ editing privileges to inject JavaScript payloads by reversing entity-encoding protection. Another Medium severity vulnerability, CVE-2026-85588, involves the plaintext storage of live TOTP shared secrets within user data export ZIP files, enabling attackers to bypass two-factor authentication if they obtain these archives. Finally, CVE-2026-85586, a Medium severity flaw, allows unauthenticated attackers to bypass CAPTCHA protection during question submission when a specific parameter is set, potentially leading to database pollution and excessive email notifications.
The majority of these vulnerabilities (CVE-2026-85593, CVE-2026-85592, CVE-2026-85591, CVE-2026-85590, CVE-2026-85588, CVE-2026-85587, and CVE-2026-85586) have been addressed in PhpMyFAQ version 4.1.8. However, CVE-2026-85589, which affects admin dashboard API endpoints, is patched in version 4.2.0-alpha.2. Users are strongly advised to update to the latest available versions to mitigate these security risks.
This batch of vulnerabilities underscores the importance of regular security audits and timely patching for web applications like PhpMyFAQ. The range of issues, from authentication bypass to XSS, presents a significant risk to users if left unaddressed. Promptly applying the available updates is crucial for maintaining the security and integrity of FAQ systems.