Phpmyfaq Before 4.1.9 And 4.2.0 Alpha Before 4.2.0 Beta Missing Current Password Step Up On E Mail Change Enables Account Takeover

Back www.vulncheck.com

Phpmyfaq Before 4.1.9 And 4.2.0 Alpha Before 4.2.0 Beta Missing Current Password Step Up On E Mail Change Enables Account Takeover

www.vulncheck.com • October 19, 2026

Share: View original

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

phpMyFAQ >= 0, = 0, = 4.2.0-alpha, = 4.2.0-alpha, < 4.2.0-beta

CWE-308 Use of Single-factor Authentication

GitHub Security Advisory (GHSA-7554-gx6g-xx77)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

phpMyFAQ Vulnerability Enables Account Takeover via Email Change A vulnerability in phpMyFAQ versions before 4.1.9 and 4.2.0-alpha allows attackers to change a user's email without requiring the current password, enabling account takeover. An attacker with a stolen session can change the email to their own, then reset the password using the platform's password reset feature. This flaw circumvents protections added in previous advisories, particularly affecting accounts without two-factor authentication (2FA). While 2FA accounts are less vulnerable, the attacker can still gain control over the account by resetting the password and email. The vulnerability has been confirmed in versions 4.1.8 and 4.2.0-alpha. A patch is expected in version 4.1.9, but until then, users are at risk. The issue has been assigned CVE-2026-XXXX, and GitHub has published a security advisory (GHSA-7554-gx6g-xx77) detailing the flaw. 57

Extracted Entities

Vulnerabilities (1)

GHSA-7554-gx6g-xx77