CVE-2026-35672 — Vulnerability intelligence

thorsten — phpMyFAQ

Published: 2026-05-28T14:13:13.739Z

CVSS

7.5

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

Sources

• CVE-2026-35672
• Original advisory
• Original advisory
• CVE-2026-35672