phpMyFAQ Vulnerability Enables Account Takeover via Email Change

• •Vulnerability allows email change without current password, leading to account takeover.
• •Affected versions include phpMyFAQ before 4.1.9 and 4.2.0-alpha.
• •Attackers can exploit this flaw using a stolen session and CSRF token.

A vulnerability in phpMyFAQ versions before 4.1.9 and 4.2.0-alpha allows attackers to change a user's email without requiring the current password, enabling account takeover. An attacker with a stolen session can change the email to their own, then reset the password using the platform's password reset feature. This flaw circumvents protections added in previous advisories, particularly affecting accounts without two-factor authentication (2FA). While 2FA accounts are less vulnerable, the attacker can still gain control over the account by resetting the password and email. The vulnerability has been confirmed in versions 4.1.8 and 4.2.0-alpha. A patch is expected in version 4.1.9, but until then, users are at risk. The issue has been assigned CVE-2026-XXXX, and GitHub has published a security advisory (GHSA-7554-gx6g-xx77) detailing the flaw.