Description

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST /api/v3.1/register endpoints, which do not check the configuration flag enforced by the HTML registration page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T14:17:46.370Z",
  "pubdate": "2026-08-19T14:17:46.370Z",
  "executiveSummary": "An improper authorization and configuration validation vulnerability exists in phpMyFAQ versions before v4.1.6. The flaw resides in the application's API endpoints, specifically POST /api/register and POST /api/v3.1/register, which fail to enforce the security.enableRegistration configuration setting. While the HTML-based registration interface correctly honors this administrative restriction, the API endpoints process requests regardless of the global registration state. This security discrepancy allows unauthenticated remote attackers to successfully create unauthorized user accounts on systems where public registration has been explicitly disabled by administrators. The direct impact includes unauthorized resource access, potential privilege escalation vectors, and circumvention of access control policies intended to restrict platform membership. Exploitation requires no prior authentication or specialized privileges, only network accessibility to the vulnerable API routes. This poses a significant risk to affected installations by undermining perimeter security controls and administrative governance over user provisioning.",
  "technicalDetails": "The root cause of this vulnerability is a failure of centralized input validation and configuration enforcement across different interface layers within the phpMyFAQ application architecture. The affected components are the API routing and controller handlers responsible for user creation, specifically mapped to the POST /api/register and POST /api/v3.1/register endpoints. During normal operation, the web application relies on the security.enableRegistration configuration flag to determine whether new user sign-ups are permitted. The standard HTML registration interface correctly checks this boolean flag before processing registration payloads. However, the API routing layer fails to validate this same configuration state prior to instantiating user creation logic.\nThe attack flow proceeds as follows: An unauthenticated remote attacker crafts an HTTP POST request targeting either the POST /api/register or POST /api/v3.1/register endpoint. The payload contains standard user registration parameters such as username, email address, and password. Because the underlying API handlers omit the configuration check for security.enableRegistration, the application processes the incoming data stream as a valid registration request. The database interaction layer subsequently writes the new user record, granting the attacker an active account within the system.\nVulnerable versions encompass all phpMyFAQ releases prior to v4.1.6. The vulnerability is exploitable over the network via standard HTTP/HTTPS protocols without requiring any authentication credentials or elevated privileges. Post-exploitation impact depends on the default role assigned to newly registered API accounts, but typically includes authenticated access to the knowledge base, potential interaction with restricted content, and a foundation for subsequent application-layer attacks."
}