Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe

Medium · 5.3 PHP packages GHSA-8gpw-xvpf-hvx5 CVE-2026-56737 PKSA-tcxy-t63n-k6vh PKSA-p9tj-4psw-jkcc

phpMyFAQ: Two Critical Vulnerabilities Allow Administrator Account Takeover

Two vulnerabilities in phpMyFAQ (CVE-2026-56737 and CVE-2026-56736) can be combined or used independently to take over administrator accounts: a two-factor authentication bypass and a stored XSS flaw in the FAQ submission/review workflow. Updates are available.

Synthesized by AI from 8 sources · updated 1 hour ago
Sources · merged by AI 8 total

AI summary

Two separate vulnerabilities have been disclosed in phpMyFAQ, an open source FAQ web application. The first allows an unauthenticated attacker to bypass the password factor of two-factor authentication (2FA) and take over any 2FA-enabled account, including administrators. The second is a stored cross-site scripting (XSS) flaw in the FAQ submission and admin review workflow that can lead to administrator session theft. Both issues have fixes available and are tracked under separate CVE identifiers.

What happened

Two distinct security issues were disclosed in phpMyFAQ. CVE-2026-56737 is an authentication bypass in the public two-factor authentication verification flow: an unauthenticated attacker can submit an account's numeric user ID together with a valid or brute-forced six-digit TOTP code, without first supplying the account password, and gain access to the account. CVE-2026-56736 is a stored XSS vulnerability where a user-submitted FAQ entry containing injected JavaScript executes in an administrator's browser when the administrator reviews or edits that entry, enabling session theft and admin account takeover.

Technical cause

For CVE-2026-56737, the 2FA verification endpoint does not require a session established through successful password authentication before accepting a TOTP code, so the password factor can be skipped entirely. For CVE-2026-56736, the application calls html_entity_decode() after strip_tags() has already processed input, which converts encoded HTML entities back into executable HTML. The admin template then renders this content using Twig's |raw filter without further output sanitization, allowing injected script to execute in the administrator's browser.

Why it matters

Both vulnerabilities can result in full compromise of administrator accounts. The 2FA bypass (CVE-2026-56737) removes the protection that 2FA is meant to provide, allowing account takeover by an unauthenticated attacker who only needs a numeric user ID and a TOTP code. The stored XSS (CVE-2026-56736) can be triggered through the public FAQ submission form by any unauthenticated or low-privileged user, and executes with administrator privileges once reviewed, enabling session theft and subsequent administrative control of the application.

Affected versions

CVE-2026-56737 affects phpMyFAQ (packages thorsten/phpmyfaq and phpmyfaq/phpmyfaq) versions 3.2.0 up to but not including 4.1.6. CVE-2026-56736 affects versions before 4.2.0-alpha (the description notes it affects all versions prior to that release).

Fixes and mitigation

CVE-2026-56737 is fixed in version 4.1.6, which binds TOTP verification to a session established after successful password authentication and limits failed TOTP attempts. No official workaround is documented for this issue. CVE-2026-56736 is fixed in version 4.2.0-alpha.

Recommended action

Administrators running phpMyFAQ should upgrade to version 4.1.6 or later to remediate the 2FA bypass, and to version 4.2.0-alpha or later to remediate the stored XSS issue. Given that no workaround exists for the 2FA bypass, upgrading is the only documented remediation path.

PatchBriefing score

5.3 / 10 · Medium

Official CVSS: 8.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Why this score

Both vulnerabilities carry a high CVSS base score (8.1 for CVE-2026-56737 and 8.2 for CVE-2026-56736), reflecting their potential for complete compromise of confidentiality and integrity through administrator account takeover. The computed PatchBriefing scores (5.3 and 5.1) reflect the CVSS base score combined with the fact that both issues are exploitable by unauthenticated, remote attackers, with no evidence currently of active exploitation, public exploit code, or EPSS data indicating elevated near-term exploitation likelihood.

Affected versions

thorsten/phpmyfaq >= 3.2.0, < 4.1.6
vulnerable
thorsten/phpmyfaq >=3.2.0,<4.1.6
vulnerable
≥ 4.1.6
patched
phpmyfaq/phpmyfaq >= 3.2.0, < 4.1.6
vulnerable
phpmyfaq/phpmyfaq >=3.2.0,<4.1.6
vulnerable
≥ 4.1.6
patched
thorsten/phpmyfaq < 4.2.0-alpha
vulnerable
thorsten/phpmyfaq <4.2.0-alpha
vulnerable
≥ 4.2.0-alpha
patched
phpmyfaq/phpmyfaq < 4.2.0-alpha
vulnerable
phpmyfaq/phpmyfaq <4.2.0-alpha
vulnerable
≥ 4.2.0-alpha
patched

Reported fixes

CVE-2026-56737 is fixed in version 4.1.6, which binds TOTP verification to a session established after successful password authentication and limits failed TOTP attempts. No official workaround is documented for this issue. CVE-2026-56736 is fixed in version 4.2.0-alpha.

How this was built

8 source records were collected, matched and used to prepare the report above.

  • GitHub Advisory Database database
  • Packagist Security Advisories registry
  • Packagist Security Advisories registry
  • NVD (NIST) database
  • GitHub Advisory Database database
  • Packagist Security Advisories registry
Unified report
phpMyFAQ: Two Critical Vulnerabilities Allow Administrator Account Takeover
1 article · 8 sources cited
Revision history
  1. Published
  2. Generated
LOW 1.9 PHP packages 10 Oct CVE-2026-107848 — Contao: CSRF in backend actions Contao contains a cross-site request forgery (CSRF) bug that allows authenticated backend users to trigger state-changing backend actions via specially crafted URLs. The issue is fixed in 5.3.50 and 5.7.12. (CVE-2026-107848, GHSA-9ff2-p842-45wq). Read full report → LOW 2.6 PHP packages 10 Oct Contao: improper access control in TableAccessVoter (CVE-2026-107851) A caching bug in contao/core-bundle's TableAccessVoter can let a low-privileged backend user access tables outside assigned module permissions; the issue is fixed in 5.7.12. (CVE-2026-107851) Read full report → LOW 2.6 PHP packages 10 Oct Contao: Improper access control in preview links (CVE-2026-107850) A flaw in contao/core-bundle allows non-admin backend users with the preview_link module to list tl_preview_link records, obtain signed share URLs from other users, and view unpublished pages they lack permission for. The issue is fixed by the vendor in 5.7.12. (Sources: 3965, 4166, 8435, 32350) Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email