CVE-2026-76208

HighCVSS 8.2/10Last modified Sep 30, 2026

Description

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus('active') unconditionally, which overwrites the account_status column of a pre-existing local account from 'blocked' to 'active'. As a result, a user whose local phpMyFAQ account has been administratively blocked can restore their account and log in by authenticating via LDAP. The state transition is not logged, so administrators cannot detect that the block was overridden. Fixed in 4.1.7.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-778

Affected software

Vendor	Product	Versions
thorsten	phpMyFAQ	>= 3.1.0, <= 4.1.6

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8pr3-q3cw-q234Exploit, Vendor Advisory
https://www.vulncheck.com/advisories/phpmyfaq-through-authentication-bypass-via-ldapThird Party Advisory
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8pr3-q3cw-q234Exploit, Vendor Advisory

Timeline

Published: Aug 19, 2026
Last modified: Sep 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-762094.3phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user CVE-2026-76214.3The SMTP2GO for WordPress – Email Made Easy plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, CVE-2026-762106.5phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to crea CVE-2026-762114.3phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearc CVE-2026-762125.3phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character ('=CVE-2026-762137.4phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped CVE-2026-762147.4phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves CVE-2026-762155.3phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unaut CVE-2026-762167.5Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principal CVE-2026-762176.5GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout CVE-2026-762188.8GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Att CVE-2026-762198.1GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.me