https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 08:37:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329548 EUVD-2026-329548 https://cve.radiocsirt.org/vuln/euvd-2026-329548 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35671 <p>phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user&#39;s password without authorization verification. An attacker with low-privilege admin credentials can escalate to SuperAdmin by modifying the userId parameter in the overwrite-password API request.</p> <p>phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user&#39;s password without authorization verification. An attacker with low-privilege admin credentials can escalate to SuperAdmin by modifying the userId parameter in the overwrite-password API request.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-35671 https://cve.radiocsirt.org/vuln/ghsa-xvp4-phqj-cjr3 <p><strong>Affected:</strong> Packagist: thorsten/phpmyfaq, Packagist: phpmyfaq/phpmyfaq</p> <p>### Summary An Insecure Direct Object Reference (IDOR) vulnerability in phpMyFAQ&#39;s Admin API allows any authenticated administrator to change the password of any user account, including SuperAdmin accounts (userId=1), without authorization verification. An attacker with a low-privilege admin account can escalate privileges to full SuperAdmin control by simply changing the target user&#39;s ID in the API request body.</p> <p>### Details File: phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/UserController.php Lines: 232-271 The overwritePassword() method at line 232 accepts PUT requests to /admin/api/user/overwrite-password: #[Route(path: &#39;user/overwrite-password&#39;, name: &#39;admin.api.user.overwrite-password&#39;, methods: [&#39;PUT&#39;])] ```php public function overwritePassword(Request $request): JsonResponse { $this-&gt;userHasUserPermission(); // Only checks if user has USER_EDIT permission $currentUser = CurrentUser::getCurrentUser($this-&gt;configuration); $data = json_decode($request-&gt;getContent()); $userId = Filter::filterVar($data-&gt;userId, FILTER_VALIDATE_INT); // User-controlled! $csrfToken = Filter::filterVar($data-&gt;csrf, FILTER_SANITIZE_SPECIAL_CHARS); $newPassword = Filter::filterVar($data-&gt;newPassword, FILTER_SANITIZE_SPECIAL_CHARS); $retypedPassword = Filter::filterVar($data-&gt;passwordRepeat, FILTER_SANITIZE_SPECIAL_CHARS); if (!Token::getInstance($this-&gt;session)-&gt;verifyToken(page: &#39;overwrite-password&#39;, requestToken: $csrfToken)) { return $this-&gt;j…</p> <p><strong>Affected:</strong> Packagist: thorsten/phpmyfaq, Packagist: phpmyfaq/phpmyfaq</p> <p>### Summary An Insecure Direct Object Reference (IDOR) vulnerability in phpMyFAQ&#39;s Admin API allows any authenticated administrator to change the password of any user account, including SuperAdmin accounts (userId=1), without authorization verification. An attacker with a low-privilege admin account can escalate privileges to full SuperAdmin control by simply changing the target user&#39;s ID in the API request body.</p> <p>### Details File: phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/UserController.php Lines: 232-271 The overwritePassword() method at line 232 accepts PUT requests to /admin/api/user/overwrite-password: #[Route(path: &#39;user/overwrite-password&#39;, name: &#39;admin.api.user.overwrite-password&#39;, methods: [&#39;PUT&#39;])] ```php public function overwritePassword(Request $request): JsonResponse { $this-&gt;userHasUserPermission(); // Only checks if user has USER_EDIT permission $currentUser = CurrentUser::getCurrentUser($this-&gt;configuration); $data = json_decode($request-&gt;getContent()); $userId = Filter::filterVar($data-&gt;userId, FILTER_VALIDATE_INT); // User-controlled! $csrfToken = Filter::filterVar($data-&gt;csrf, FILTER_SANITIZE_SPECIAL_CHARS); $newPassword = Filter::filterVar($data-&gt;newPassword, FILTER_SANITIZE_SPECIAL_CHARS); $retypedPassword = Filter::filterVar($data-&gt;passwordRepeat, FILTER_SANITIZE_SPECIAL_CHARS); if (!Token::getInstance($this-&gt;session)-&gt;verifyToken(page: &#39;overwrite-password&#39;, requestToken: $csrfToken)) { return $this-&gt;j…</p> https://cve.radiocsirt.org/vuln/ghsa-xvp4-phqj-cjr3