---
id: CVE-2026-85592
title: >-
  phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the
  question creation endpoint where the isAddingQuestionsAllowed() method grants
  access to all callers when main.enableAskQuestions is enabled, ignoring the
  records…
summary: >-
  phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the
  question creation endpoint where the isAddingQuestionsAllowed() method grants
  access to all callers when main.enableAskQuestions is enabled, ignoring the
  records…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-863
published: '2026-09-04'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:05:53.177'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85592'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-546h-9ghq-x49g
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-authorization-bypass-via-question-create
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-546h-9ghq-x49g
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00249
epssPercentile: 0.16503
ingestedAt: '2026-09-08T20:10:03.165Z'
---

## Overview

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers can submit questions via the question/create API endpoint to bypass guest submission restrictions and inject spam into the admin moderation queue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.