---
id: CVE-2026-111892
title: >-
  phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset
  Endpoints
summary: >-
  phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the
  unauthenticated user/password/update and user/password/reset endpoints.
  Unauthenticated attackers can send unlimited reset requests to flood a
  registered user's …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-307
vendor: thorsten
product: phpMyFAQ
affected:
  - phpMyFAQ >= 4.2.0-alpha < 4.2.0-beta
published: '2026-10-17'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T18:46:15.921Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111892'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-p2cj-r7vv-fr2r
    label: GitHub Security Advisory (GHSA-p2cj-r7vv-fr2r)
  - url: >-
      https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-rate-limiting-on-password-reset-endpoints
    label: >-
      VulnCheck Advisory: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate
      Limiting on Password-Reset Endpoints
tags:
  - cve.org
ingestedAt: '2026-10-17T19:08:56.923Z'
---

## Overview

phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.

## Affected

- `phpMyFAQ >= 4.2.0-alpha < 4.2.0-beta`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.