CVE-2026-76208

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus('active') unconditionally, which overwrites the account_status column of a pre-existing local account from 'blocked' to 'active'. As a result, a user whose local phpMyFAQ account has been administratively blocked can restore their account and log in by authenticating via LDAP. The state transition is not logged, so administrators cannot detect that the block was overridden. Fixed in 4.1.7.

• CWE-778

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8pr3-q3cw-q234Exploit, Vendor Advisory
• https://www.vulncheck.com/advisories/phpmyfaq-through-authentication-bypass-via-ldapThird Party Advisory
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8pr3-q3cw-q234Exploit, Vendor Advisory

Published

Aug 19, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76201Adobe Commerce is affected by a stored Cross-Site Scripting …9.3
• CVE-2026-76202Adobe Commerce is affected by an Incorrect Authorization vul…8.2
• CVE-2026-76203Incorrect Behavior Order: Validate Before Canonicalize in th…5.1
• CVE-2026-76205phpMyFAQ before 4.1.7 contains a SQL injection vulnerability…8.1
• CVE-2026-76206phpMyFAQ versions before 4.1.7 fail to validate active statu…5.3
• CVE-2026-76207phpMyFAQ before 4.1.7 contains a two-factor authentication b…8.1
• CVE-2026-76209phpMyFAQ versions before v4.1.6 fail to validate the securit…4.3
• CVE-2026-7621The SMTP2GO for WordPress – Email Made Easy plugin for WordP…4.3
• CVE-2026-76210phpMyFAQ before 4.1.6 does not adequately sanitize HTML in F…6.5
• CVE-2026-76211phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATIO…4.3
• CVE-2026-76212phpMyFAQ before 4.1.7, when configured to use PostgreSQL via…5.3
• CVE-2026-76213phpMyFAQ before 4.1.7 contains a brute-force vulnerability i…7.4