phpMyFAQ 4.2.0-alpha releases before 4.2.0-beta allow an unauthenticated attacker to send unlimited reset requests to the user/password/update and user/password/reset endpoints. Because no rate limiting is enforced, a malicious actor can flood a registered user’s inbox with reset emails, exhausting the mailer and server resources.

The affected product is phpMyFAQ from the vendor thorsten. All releases prior to 4.2.0-beta—including 4.2.0-alpha—are vulnerable. The issue applies to any deployment of phpMyFAQ that has not been updated to the 4.2.0-beta release or later where rate limiting has been added.

The CVSS score is 6.9, indicating moderate severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified, but the lack of authentication controls and the ability to send unlimited requests suggests a viable attack vector. The vulnerability is not listed in the CISA KEV catalog, but an attacker can still achieve significant resource exhaustion by abusing the reset flow without needing privileged access.