CVE-2026-75918
Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.
- CVSS 4.0
- 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.34% probability · 27th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- phpmyfaq/phpmyfaq
- Source
- disclosure@vulncheck.com
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j5w2-cwwj-xj7xExploit, Vendor Advisory
- https://www.vulncheck.com/advisories/phpmyfaq-before-authentication-bypass-via-tracking-fileThird Party Advisory
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j5w2-cwwj-xj7xExploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.