phpMyFAQ versions 3.1.0 through 4.1.6 contain a flaw in AuthLdap::create() that, after a successful LDAP bind, unconditionally sets a local account status to active. This overwrites a blocked account, allowing a user whose local phpMyFAQ account has been administratively blocked to regain access via LDAP. No audit log entry is produced for the state transition, so the restoration can occur without administrative notice.

Affecting deployments running phpMyFAQ 3.1.0 through 4.1.6 with LDAP authentication enabled, any user mapped via LDAP to a locally blocked account is vulnerable until the system is updated to version 4.1.7 or later.

The vulnerability scores 8.8 on the CVSS scale, indicating high severity, and it is not listed in the CISA KEV catalog. The EPSS score is below 1%, indicating a very low probability of exploitation in the wild. Based on the description, it is inferred that exploitation most likely occurs over the web interface by authenticating via LDAP; the attacker would need LDAP access to the target account and can trigger the status change silently, resulting in unauthorized access without detection.