Security Advisory

CVE-2026-35671

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-28 14:13:12

Last updated 2026-06-23 16:16:22

Assigner VulnCheck

CVSS score 8.8

State PUBLISHED

Description

phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials can escalate to SuperAdmin by modifying the userId parameter in the overwrite-password API request.

← Browse all CVEs View on cve.org ↗