The vulnerability in phpMyFAQ allows an attacker who has hijacked a user session to change the account e‑mail address without providing the current password. Once the e‑mail is changed, the attacker can initiate the password‑reset workflow and take over accounts that do not have two‑factor authentication enabled, including super‑administrator accounts. The weakness resides in an inadequate authorization check (CWE‑308).

All installations of phpMyFAQ from vendor thorsten, prior to version 4.1.9 and 4.2.0‑alpha before 4.2.0‑beta, are affected. The issue occurs in the user control panel handling "UserController::updateData" and the API endpoint "api/user/data/update".

The CVSS score of 8.7 indicates a high severity for this flaw. The EPSS score is not available, but the lack of a current‑password check makes exploitation straightforward for anyone who can hijack a session. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector requires session hijacking; the attacker does not need any privileged user credentials. Once a session is compromised, changing the e‑mail followed by a password reset enables the attacker to fully control the account.