The bug allows an attacker to use the question/create API to add questions when the main.enableAskQuestions flag is on, even though the records.allowQuestionsForGuests setting is meant to block guest submissions. Because the isAddingQuestionsAllowed() method ignores that setting, anyone can submit questions without authentication, resulting in spam or unwanted content flooding the admin moderation queue. This represents a privilege escalation flaw in the application’s access control and is classified as CWE-863.

The vulnerability affects phpMyFAQ installations of any version earlier than 4.1.8, distributed by the vendor thorsten. Users running a pre‑4.1.8 build and having the question feature turned on are within scope.

The CVSS score of 6.3 places the issue in the moderate category. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation reports yet. Attackers can reach the vulnerable endpoint over the web without needing credentials; they only need the site’s URL and enableAskQuestions enabled. The impact is limited to spam injection, but the ease of exploitation and the potential to flood the moderation pipeline make it a significant operational concern.