CVE-2026-76209

4.3 Moyenne

Publiée le 19/08/2026 à 16:17 · Modifiée le 01/09/2026 à 17:21 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST /api/v3.1/register endpoints, which do not check the configuration flag enforced by the HTML registration page.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.3 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	4.3 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-862

Références

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h7q4-qgc4-c9vm ExploitMitigationVendor Advisory
https://www.vulncheck.com/advisories/phpmyfaq-before-registration-bypass-via-api Third Party Advisory

CVE-2026-76209

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs