What is CVE-2026-76209?
This vulnerability allows attackers to bypass disabled registration in phpMyFAQ versions prior to v4.1.6 by exploiting the lack of validation on the 'security.enableRegistration' setting in API endpoints. By sending requests to POST /api/register, unauthorized user accounts can be created, necessitating an immediate update to version v4.1.6 to restore the registration restriction.
Azərbaycanca: Bu boşluq phpMyFAQ v4.1.6-dan əvvəlki versiyalarda "security.enableRegistration" parametrinin API endpoint'lərində yoxlanılmaması səbəbindən qeydiyyat qapalı olsa belə, hücumçulara POST /api/register sorğuları vasitəsilə istifadəçi hesabı yaratmağa imkan verir. Təsirə məruz qalan sistemlərdə qeydiyyat məhdudiyyətini bərpa etmək üçün dərhal v4.1.6 versiyasına yeniləmə aparılmalıdır.
Related CVEs
link basis: same weakness class CWE-306
FAQ2
How does CVE-2026-76209 allow user creation in phpMyFAQ even when registration is disabled?
The vulnerability arises from the lack of validation on the 'security.enableRegistration' setting in API endpoints. Attackers can bypass the registration restriction by sending POST /api/register requests to create unauthorized user accounts.
Which version should be updated to in order to mitigate CVE-2026-76209?
To mitigate this vulnerability, an immediate update to phpMyFAQ version v4.1.6 is required.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.