The vulnerability exists in phpMyFAQ versions prior to 4.1.6. The software fails to validate the security.enableRegistration setting on API endpoints, which means attackers can submit POST requests to /api/register or /api/v3.1/register and create user accounts even when registration is disabled. This flaw allows unauthorized account creation, giving an attacker access to the application with the privileges of the created account. The weakness is a lack of proper access control, identified as CWE-862.

Affected vendors include thorsten’s phpMyFAQ product. Any installation of phpMyFAQ older than version 4.1.6 is vulnerable. The issue applies to all API endpoints that support registration.

The CVSS score for this issue is 5.3, indicating a moderate severity. Because the flaw is in publicly exposed API endpoints, an attacker with network access can exploit it remotely by sending crafted POST requests. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting the available evidence of exploitation is limited. However, the impact of creating unauthorized accounts can be significant if the application grants administrative or sensitive access to new users. The flaw is directly related to unauthorized access, and no additional exploitation prerequisites beyond remote API access are needed.