The vulnerability occurs when phpMyFAQ's user tracking feature is enabled. The application writes password reset tokens to a tracking file that is publicly readable. An attacker who does not need any credentials can view the token file, copy reset tokens, and use the password reset API to change accounts, effectively bypassing authentication. The weakness is an information exposure flaw (CWE‑200).

The flaw is present in the phpMyFAQ application provided by Thorsten in versions prior to 4.1.7. The tracking file (content/core/data/trackingDDMMYYYY) is accessible to all visitors when user tracking is activated.

The CVSS base score is 8.7, indicating high severity. EPSS score is <1%, but the absence of a KEV listing does not preclude exploitation. An unauthenticated attacker can exploit the publicly readable file and reset user passwords with minimal effort, making this a low‑effort, high‑impact attack. The likely attack vector is through web requests that expose the tracking file, leading to account takeover and possible access to sensitive data.