Information Exposure in phpMyFAQ Password Reset Mechanism

phpMyFAQ versions prior to 4.1.7 contain a security vulnerability (CVE-2026-75918) that results in the exposure of sensitive authentication data. When the user tracking feature is enabled within the application, the system logs password reset tokens into a tracking file stored at a predictable and publicly accessible location: content/core/data/trackingDDMMYYYY. This flaw allows an unauthenticated, remote attacker to download these files, extract valid reset tokens, and subsequently replay them against the application's password reset API. Successful exploitation permits the attacker to bypass authentication and take full control over targeted user accounts. The vulnerability is highly critical due to the ease of access to the token files and the lack of authentication required to perform the initial information gathering.

Impact

Successful exploitation leads to a complete account takeover of any user who initiates a password reset while the tracking feature is active. This can affect all users of an impacted phpMyFAQ instance, including administrative accounts. In environments where phpMyFAQ is used for enterprise knowledge management, this could lead to significant unauthorized access to sensitive internal documentation and credentials stored within the system.

Recommendation

Prioritize the immediate update of all phpMyFAQ instances to version 4.1.7 or later to remediate CVE-2026-75918. In the interim, detection engineering teams should implement monitoring for unauthorized access to the tracking file path.

• Deploy the provided Sigma rule to detect requests targeting the tracking file.
• Audit existing web server access logs for any GET requests matching the path pattern 'content/core/data/tracking*' to identify potential past exploitation attempts.
• Disable the user tracking feature in phpMyFAQ configuration until the software can be patched to prevent further token leakage.