{"id":"CVE-2026-111892","kind":"vulnerability","aliases":["CVE-2026-111892"],"related":[],"title":"phpMyFAQ: missing rate limits let anyone flood password reset emails","description":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta does not effectively rate limit its unauthenticated password update and reset endpoints. An unauthenticated attacker can send unlimited reset requests, flooding a registered user's inbox and exhausting mailer and server resources.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["endpoints-not-exposed","patched-version"],"how_to_check":"- Check the installed version, e.g. `grep -i version phpmyfaq/inc/Constants.php` or the admin dashboard, and see whether it is in the range 4.2.0-alpha up to but not including 4.2.0-beta.\n- Confirm whether the password reset form at user/password/reset is reachable from the internet.","fix":"- Upgrade phpMyFAQ to `4.2.0-beta` or later, as the description states the flaw is fixed there.\n- unknown whether a configuration-only mitigation exists.","status":"open","published_at":"2026-10-17T19:16:30+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:42:18+00:00","updated_at":"2026-10-25T03:42:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:42:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.2.0-beta` or later, as the description states the flaw is fixed there.\n- unknown whether a configuration-only mitigation exists.","reach":"internet","title":"phpMyFAQ: missing rate limits let anyone flood password reset emails","impact":"low","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta does not effectively rate limit its unauthenticated password update and reset endpoints. An unauthenticated attacker can send unlimited reset requests, flooding a registered user's inbox and exhausting mailer and server resources.","category":"package","nicknames":[],"who_cares":["phpmyfaq","php","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Registered users get flooded with reset emails; mailer and server resources get exhausted.","analyst_note":"","how_to_check":"- Check the installed version, e.g. `grep -i version phpmyfaq/inc/Constants.php` or the admin dashboard, and see whether it is in the range 4.2.0-alpha up to but not including 4.2.0-beta.\n- Confirm whether the password reset form at user/password/reset is reachable from the internet.","needs_analyst":false,"not_affected_if":["patched-version","endpoints-not-exposed"],"who_is_affected":"Sites running phpMyFAQ 4.2.0-alpha before 4.2.0-beta that expose the password reset endpoints to unauthenticated visitors are affected. Installations on an earlier or later release, or where those endpoints are not reachable from outside, have less exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3345,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111892':13A,16A '-2026':12A,15A '4.2.0':24B,27B,62C,65C 'alpha':25B,63C 'anyon':6A 'attack':43B,79C 'beta':28B,66C 'cve':11A,14A 'effect':31B,68C 'email':10A,94C 'endpoint':40B,77C 'exhaust':56B,95C 'flood':7A,49B,86C 'host':22B 'inbox':54B,91C 'lack':67C 'let':5A 'limit':4A,33B,70C 'mailer':57B,96C 'miss':2A 'packag':17B 'password':8A,36B 'php':18B 'phpmyfaq':1A,19B,23B,61C 'rate':3A,32B,69C 'regist':51B,88C 'request':48B,84C 'reset':9A,39B,47B,83C,93C 'resourc':60B,99C 'self':21B 'self-host':20B 'send':45B,81C 'server':59B,98C 'unauthent':35B,42B,73C,78C 'unlimit':46B,82C 'updat':37B 'user':52B,89C 'user/password/reset':76C 'user/password/update':74C","nicknames":[],"mitigations":[],"who_affected":"Sites running phpMyFAQ 4.2.0-alpha before 4.2.0-beta that expose the password reset endpoints to unauthenticated visitors are affected. Installations on an earlier or later release, or where those endpoints are not reachable from outside, have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111892","severity":null,"published_at":"2026-10-17T19:16:30+00:00","modified_at":"2026-10-19T22:17:04+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}