What’s Vulnerable › Vulnerabilities

CVE-2026-76208: phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-19 · updated 2026-09-30
• Weakness: CWE-778

Description

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus('active') unconditionally, which overwrites the account_status column of a pre-existing local account from 'blocked' to 'active'. As a result, a user whose local phpMyFAQ account has been administratively blocked can restore their account and log in by authenticating via LDAP. The state transition is not logged, so administrators cannot detect that the block was overridden. Fixed in 4.1.7.

Affected products

• thorsten phpMyFAQ: from 3.1.0 before 4.1.6 — fixed in 4.1.6

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.1.6. Check the vendor advisory for mitigations.

References

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8pr3-q3cw-q234
• https://www.vulncheck.com/advisories/phpmyfaq-through-authentication-bypass-via-ldap
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8pr3-q3cw-q234

Get alerted when CVE-2026-76208 or the next vulnerability affects your stack