The vulnerability allows an attacker to reset a valid user’s password without prior authentication. By sending a PUT request to the /api/index.php/user/password/update endpoint, an adversary can change the account password without providing a reset token or having valid credentials. This flaw also enables enumeration of existing username and email pairs, which can further ease credential compromise.

Thorsten’s phpMyFAQ installations running any version prior to 4.1.3 are susceptible to this issue. The flaw exists in the core API handling for user password updates and affects all deployments of phpMyFAQ that have not applied the latest patch beyond 4.1.3.

The CVSS score of 8.8 indicates a high severity vulnerability, and the lack of an EPSS score suggests no publicly reported exploitation at this time, though the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as an unauthenticated HTTP request can trigger the password change, meaning that an attacker only needs network access to the API endpoint to exploit the flaw.