The vulnerability in phpMyFAQ versions prior to 4.1.8 permits an authenticated attacker with session access to change a user's password without verifying the current password. By submitting a PUT request accompanied only by a valid CSRF token to the user data update endpoint, the attacker can silently overwrite any account password, including administrator accounts, resulting in irreversible account takeover and lockout.

This issue affects installations of the phpMyFAQ application made by the vendor thorsten. All deployments running versions older than 4.1.8 are susceptible. System administrators should verify their installed version and ensure it has been updated to 4.1.8 or a later release.

The CVSS vector score of 7.1 indicates medium to high severity. Exploitation requires the attacker to already possess a valid authenticated session and the ability to craft a PUT request with an accepted CSRF token. No exploit probability information is available and the vulnerability is not listed as a known exploited vulnerability by CISA. Nevertheless, the ability to perform credential changes without authentication checks represents a serious authorization flaw and warrants prompt remediation.