CVE-2026-27836

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27836", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-24T02:32:39.801Z", "datePublished": "2026-02-27T19:54:51.992Z", "dateUpdated": "2026-03-03T20:25:01.562Z"}, "containers": {"cna": {"title": "phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w22q-m2fm-x9f4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w22q-m2fm-x9f4"}, {"name": "https://github.com/thorsten/phpMyFAQ/commit/f2ab673f0668753cd0f7c7c8bc7fd2304dcf5cb1", "tags": ["x_refsource_MISC"], "url": "https://github.com/thorsten/phpMyFAQ/commit/f2ab673f0668753cd0f7c7c8bc7fd2304dcf5cb1"}], "affected": [{"vendor": "thorsten", "product": "phpMyFAQ", "versions": [{"version": "< 4.0.18", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T19:54:51.992Z"}, "descriptions": [{"lang": "en", "value": "phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Version 4.0.18 fixes the issue."}], "source": {"advisory": "GHSA-w22q-m2fm-x9f4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T20:24:53.798510Z", "id": "CVE-2026-27836", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T20:25:01.562Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27836", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T20:24:53.798510Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T20:24:58.288Z"}}], "cna": {"title": "phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint", "source": {"advisory": "GHSA-w22q-m2fm-x9f4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "thorsten", "product": "phpMyFAQ", "versions": [{"status": "affected", "version": "< 4.0.18"}]}], "references": [{"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w22q-m2fm-x9f4", "name": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w22q-m2fm-x9f4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/thorsten/phpMyFAQ/commit/f2ab673f0668753cd0f7c7c8bc7fd2304dcf5cb1", "name": "https://github.com/thorsten/phpMyFAQ/commit/f2ab673f0668753cd0f7c7c8bc7fd2304dcf5cb1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Version 4.0.18 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T19:54:51.992Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27836", "state": "PUBLISHED", "dateUpdated": "2026-03-03T20:25:01.562Z", "dateReserved": "2026-02-24T02:32:39.801Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-27T19:54:51.992Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "phpMyFAQ", "vendor": "thorsten", "versions": [{"status": "affected", "version": "< 4.0.18"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*", "matchCriteriaId": "14734A01-00F7-4499-A5DA-1FA0888B75A8", "versionEndExcluding": "4.0.18", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Version 4.0.18 fixes the issue."}, {"lang": "es", "value": "phpMyFAQ es una aplicaci\u00f3n web de preguntas frecuentes de c\u00f3digo abierto. Antes de la versi\u00f3n 4.0.18, el endpoint de preparaci\u00f3n de WebAuthn ('/API/webauthn/prepare') crea nuevas cuentas de usuario activas sin ninguna autenticaci\u00f3n, protecci\u00f3n CSRF, captcha o comprobaciones de configuraci\u00f3n. Esto permite a atacantes no autenticados crear cuentas de usuario ilimitadas incluso cuando el registro est\u00e1 deshabilitado. La versi\u00f3n 4.0.18 corrige el problema."}], "id": "CVE-2026-27836", "lastModified": "2026-06-17T10:27:46.023", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27836", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T20:24:53.798510Z", "version": "2.0.3"}}]}, "published": "2026-02-27T20:21:40.330", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/thorsten/phpMyFAQ/commit/f2ab673f0668753cd0f7c7c8bc7fd2304dcf5cb1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w22q-m2fm-x9f4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.18)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "phpMyFAQ", "source": "cna", "vendor": "thorsten"}, "product": "phpmyfaq", "vendor": "thorsten"}], "analysis": {"en": {"generated_at": "2026-04-17T13:56:22.449263+00:00", "value": {"mitigation_remediation": ["Update phpMyFAQ to version 4.0.18 or later, which removes the unauthenticated account creation flaw.", "If an immediate upgrade is not possible, restrict access to the /api/webauthn/prepare endpoint \u2013 for example by blocking the URL in the web server configuration or limiting it to the localhost interface.", "Implement additional controls such as rate limiting or CAPTCHA on account\u2011creation endpoints, and disable the registration feature in the application configuration to reduce the risk of unauthenticated account creation."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated Account Creation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects phpMyFAQ installations from thorsten running any version prior to 4.0.18; no additional sub-components are listed.", "description_and_impact": "A request to the WebAuthn prepare endpoint creates new, active user accounts without requiring any form of authentication, CSRF protection, captcha, or configuration checks. The flaw allows an attacker to create an unlimited number of accounts even when the application\u2019s registration feature is disabled. This could enable malicious users to gain access to internal resources, perform spam or phishing campaigns, or evade rate\u2011limiting controls. The weakness is a classic \"Missing Authorization\" error (CWE\u2011862).", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity: the vulnerability can be exploited remotely with no authentication and would lead to a significant increase in the attack surface. The EPSS score of less than 1% suggests that, while exploitability exists, the probability of exploitation in the near term is small. The vulnerability is not included in the CISA KEV catalog, pointing to an absence of known large\u2011scale exploitation. Because the endpoint is reachable over HTTP/HTTPS and requires no credentials, the attack vector is straightforward \u2013 simply sending a crafted request to /api/webauthn/prepare. With no CSRF or other mitigations in place, a single web request suffices to create an account, enabling further attack activities."}}}}, "created": "2026-03-02T12:05:02.705145+00:00", "updated": "2026-04-17T14:00:15.815420+00:00", "vendors": ["thorsten", "thorsten$PRODUCT$phpmyfaq"]}