The vulnerability is an insecure direct object reference in the admin API user password endpoint of phpMyFAQ, allowing an authenticated administrator to modify any user’s password without performing proper authorization checks. An attacker with low‑privilege administrator credentials can change a target user’s password by supplying a different userId in the overwrite‑password request, thereby elevating privileges to a SuperAdmin role. This flaw permits unauthorized password resets and potential full system takeover, affecting confidentiality, integrity, and availability.

The issue affects the phpMyFAQ application produced by thorsten:phpMyFAQ. Versions prior to 4.1.3 are vulnerable; only the unsupported releases before the 4.1.3 release contain the flaw.

The CPE identifies phpMyFAQ, and the CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation yet. However, the flaw can be exploited by any user who already possesses low‑privilege administrative access, enabling them to change any user's password and potentially elevate to SuperAdmin. Successful exploitation permits unauthorized password resets and possible full administrative control.