CVE-2026-75918: phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-08-19 · updated 2026-09-01
Weakness: CWE-200

Description

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.

Affected products

thorsten phpMyFAQ: before 4.1.7 — fixed in 4.1.7

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.1.7. Check the vendor advisory for mitigations.

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j5w2-cwwj-xj7x
https://www.vulncheck.com/advisories/phpmyfaq-before-authentication-bypass-via-tracking-file
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j5w2-cwwj-xj7x

Get alerted when CVE-2026-75918 or the next vulnerability affects your stack