CVE-2026-111892
CVE-2026-111892 · phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints
This page contains facts from public vulnerability sources. Check the original advisory before updating.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.
CVSS 6.9 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
phpmyfaq
- Versions
- ≥ 4.2.0-alpha, < 4.2.0-beta: Affected (semver)
- 4.2.0-beta: Not affected (semver)
Update to 4.2.0-beta