Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

CVE-2026-35672 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceCVE-2026-35672

CVE-2026-35672

HIGH8.7

phpMyFAQ - Authentication Bypass via Empty API Token

Published May 28, 2026

Modified 3 weeks ago

Details

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28

https://www.cve.org/CVERecord?id=CVE-2026-35672

https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token

CVSS Analysis

CVSS v4.0

8.7

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

NoneVC:N

Vuln. Integrity

HighVI:H

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

8.7/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Weakness Type (CWE)

Other

Ecosystems

Timeline

PublishedMay 28, 2026

ModifiedMay 28, 2026