CVE-2026-76208

CVE-2026-76208 — Threat Intelligence Report

Executive Summary

CVE-2026-76208 is an authentication bypass vulnerability in phpMyFAQ versions 3.1.0 through 4.1.6, specifically located within the AuthLdap::create() method. When LDAP authentication is enabled, a successful LDAP bind unconditionally calls User::setStatus('active'), which overwrites the account_status column of any pre-existing local account from 'blocked' to 'active' — thereby restoring access for users who were administratively blocked. The state transition is not logged, providing no audit trail for security teams. The vulnerability carries a CVSS score of 8.2 with a High impact to integrity, requires no authentication to exploit (AV:N/AC:L/PR:N/UI:N), and is fixed in phpMyFAQ version 4.1.7.

Technical Analysis

Vulnerability Class: CWE-778 — Insufficient Logging. This CWE classification captures the dual nature of the vulnerability: the underlying flaw is an improper privilege/state transition, but the severity is amplified by the complete absence of logging for the status change, making post-exploitation detection impossible through application logs.

Affected Component: The flaw resides in the AuthLdap::create() method within phpMyFAQ's LDAP authentication module. The vulnerable code path is as follows:

1. A user attempts to authenticate via LDAP.
2. The LDAP bind operation succeeds (the user's credentials are valid in the LDAP directory).
3. Immediately following the successful bind, the code calls User::setStatus('active') unconditionally, without first checking whether the corresponding local phpMyFAQ user account that maps to the LDAP identity is currently in a 'blocked' state.
4. This call directly overwrites the account_status column in the phpMyFAQ database from 'blocked' to 'active'.

Root Cause: The logic error is the lack of a conditional guard. The correct behavior would be to only transition status to 'active' if the account is not explicitly blocked, or to respect administrative overrides. The User::setStatus() function is invoked without evaluating the existing state of account_status, meaning an administrative block is silently discarded.

Post-Authentication Flow: After the status overwrite, the authentication flow continues normally. The user's LDAP identity is validated, they are authenticated into the phpMyFAQ application, and because their local account is now 'active', the session proceeds without any additional checks. Because the setStatus transition is not logged, there is no event record in any audit log indicating that the block was overridden.

Attack Surface: The attack surface is restricted but significant — the attacker must have valid LDAP credentials AND must have a pre-existing local phpMyFAQ user account linked to that LDAP identity. However, the vulnerability is exploitable from the network (AV:N), requires no privileges (PR:N), and does not require user interaction (UI:N). The complexity is low (AC:L) because the exploitation is essentially a standard LDAP login flow.

Technical Confidence Level: The NVD description provides precise function names (AuthLdap::create(), User::setStatus('active')) and the exact database column affected (account_status). The mechanism is fully described at the code-flow level. Patches available in version 4.1.7 indicate the fix modifies either the AuthLdap::create() method to check current status before overwriting, or adds logging to the status transition. Insufficient technical detail is available regarding the exact patch implementation.

Exploitation Scenarios

Preconditions:

1. Target phpMyFAQ instance (v3.1.0–v4.1.6) has LDAP authentication enabled in its configuration.
2. Attacker possesses valid credentials for a user account in the LDAP directory.
3. That LDAP user must have a corresponding local phpMyFAQ account that has been administratively blocked (i.e., account_status column set to 'blocked').

Attack Chain:

Step 1 — Reconnaissance/Target Identification: The attacker identifies a phpMyFAQ instance through internet-wide scanning (e.g., Shodan queries for phpMyFAQ banners or page titles) or through targeted reconnaissance of an organization known to use phpMyFAQ. The attacker confirms LDAP authentication is enabled by inspecting the login page or configuration fingerprints.

Step 2 — Account Enumeration/Target Selection: The attacker identifies or guesses a username that has a local phpMyFAQ account. This could be a former employee whose account was blocked, a suspended user, or an account belonging to someone who has violated policy. Attackers may use passive LDAP enumeration techniques or organizational OSINT to identify candidate accounts.

Step 3 — Trigger (Vulnerability-Class Level): The attacker performs a standard LDAP login attempt using valid LDAP credentials for the targeted identity. From the application's perspective, this is a completely normal authentication flow: the LDAP bind succeeds, and the application proceeds to synchronize or verify the local user record. Due to the flaw, the post-bind code path calls User::setStatus('active') unconditionally, silently flipping the account_status column from 'blocked' to 'active'. No error occurs, no block guard is triggered, and no log entry is generated.

Step 4 — Post-Exploitation Impact: The attacker is now authenticated as the previously blocked user. The attacker gains:

• Full access to the phpMyFAQ knowledge base as that user.
• Any user-level privileges associated with that account (creation of articles, modification of existing content, access to restricted categories).
• If the account holds moderator or administrator privileges, the attacker could escalate to full administrative control of the phpMyFAQ instance, potentially leveraging stored XSS or other injection vectors to achieve remote code execution on the underlying server.

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

CVSS Analysis: The vulnerability scores 8.2 (High) on the CVSS v3.1 scale with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. The severity is driven by:

• Confidentiality Impact: Low — The attacker only gains access to information available to the unblocked account they hijack; this does not bypass all access controls globally.
• Integrity Impact: High — The attacker gains the ability to modify knowledge base content, credentials, or configuration depending on the compromised account's privileges. The silent status override itself represents a direct integrity failure in the account state management.
• Availability Impact: None — No denial-of-service condition results from exploitation.
• Scope: Unchanged — The compromise does not cross a security boundary into other systems.

Business Impact: phpMyFAQ is an open-source FAQ management system widely used in enterprise customer support, internal IT knowledge bases, and public-facing support portals. For organizations using it, the primary impacts are:

1. Account Control Bypass: Administrative account-blocking actions become ineffective, undermining a core security control for managing user access in disciplinary or offboarding scenarios.
2. Data Integrity Compromise: An attacker gaining access to a previously blocked (possibly disgruntled) user's account can tamper with knowledge base articles, potentially injecting malicious links, altering security documentation, or distributing incorrect configuration instructions.
3. Reputational Harm: If the FAQ system is customer-facing, modified content could mislead users or propagate false security guidance.
4. Regulatory Exposure: Lack of logging for the status transition violates audit trail requirements that many compliance frameworks (PCI-DSS, SOC 2, ISO 27001) mandate for access control changes.

Blast Radius: The vulnerability is scoped to a single phpMyFAQ instance. However, due to the SILENT nature (no logs), the window of undetected compromise is indefinite. An attacker could maintain persistent access to a hijacked account for months with zero detection probability from application logs.

Confidence Level: Medium-High. The vulnerability details are precise, but the EPSS score is not yet available, and there is no CISA KEV listing, no known exploit-in-the-wild evidence, and no detected threat actor campaigns at the time of writing.

Detection Guidance

The following detection rules target detection of either abnormal LDAP authentication sequences or anomalous account status modifications in application logs. Note: because the vulnerable code path does not log the status transition, detection is challenging — rules focus on unusual LDAP auth behavior, login patterns for previously-blocked accounts, or database-level changes to account_status.

Sigma Rule

title: phpMyFAQ - LDAP Auth Bypass - Blocked Account Login Attempt
id: 6a8fd2f3-ae4f-4e3c-9f3a-7c3e9d2b8a25
status: experimental
description: Detects successful LDAP authentication events for accounts that were previously flagged as blocked in phpMyFAQ environments (CVE-2026-76208)
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-76208
author: Valtersit Threat Research
date: 2026/01/15
logsource:
    product: phpmyfaq
    category: authentication
detection:
    selection:
        EventID: 4624  # Windows event for successful logon
        LogonType: 3   # Network logon
        AuthenticationPackageName: LDAP
    filter_known_good:
        UserName|startswith: 'svc_'
    condition: selection and not filter_known_good
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.76208
falsepositives:
    - Legitimate LDAP logins for accounts that are not blocked
    - Service accounts properly configured for LDAP

YARA Rule

rule phpMyFAQ_CVE_2026_76208_account_status_override
{
    meta:
        author = "Valtersit Threat Research"
        description = "Detects phpMyFAQ source code or database dump artifacts containing the vulnerable unconditional setStatus('active') call pattern"
        date = "2026-01-15"
        cve = "CVE-2026-76208"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76208"
        score = 80
    strings:
        $s1 = "function create" ascii wide nocase
        $s2 = "setStatus('active')" ascii wide
        $s3 = "setStatus(\"active\")" ascii wide
        $s4 = "AuthLdap" ascii wide
        $s5 = "account_status" ascii wide
        $s6 = "ldap_bind" ascii wide nocase
        $s7 = "setStatus" ascii wide
    condition:
        any of ($s1, $s4, $s6) and any of ($s2, $s3) and $s7 and $s5
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-76208 - phpMyFAQ LDAP Login Attempt for Blocked Account"; flow:established,to_server; content:"POST"; http_method; content:"index.php"; http_uri; content:"action=login"; http_uri; content:"ldap"; http_uri; pcre:"/user=[a-zA-Z0-9._-]+/i"; sid:202676208; rev:1; metadata:cve CVE-2026-76208, attack_target Web_Server, deployment Perimeter, signature_severity Major, created_at 2026_01_15;)

# Note: This rule alerts on all LDAP login attempts to phpMyFAQ.
# Because the vulnerability causes successful logins for blocked users without distinguishing
# traffic patterns, accurate detection requires correlating with account-block state (application-level).

Elastic Detection

// EQL rule: Detect login success events for accounts whose status was recently changed
// from blocked to active, or repeated login attempts against a phpMyFAQ application
// Correlates authentication events with account lifecycle events

sequence with maxspan=1h
  [ authentication where event.action == "user_login" and
    authentication.authentication_method == "LDAP" and
    process.name : "php-fpm*"
  ] by user.name
  [ auditd where event.action == "UPDATE" and
    auditd.data.field == "account_status" and
    auditd.data.old_value == "blocked" and
    auditd.data.new_value == "active"
  ] by auditd.data.subject_user

Splunk SPL Query

index=main sourcetype=phpmyfaq:authentication OR sourcetype=phpmyfaq:access
| where match(user, "(?i)ldap")
| transaction user maxspan=5m
| stats count by user, src_ip, status
| search status="success"
| lookup account_status_lookup user OUTPUT account_status
| where account_status=="blocked"
| table _time, user, src_ip, status, account_status
| eval alert="CVE-2026-76208: Blocked LDAP account logged in successfully"
| outputlookup blocked_account_logons.csv

Wazuh OSSEC Rule

<group name="phpmyfaq,">
    <rule id="100762" level="10">
        <decoded_as>json</decoded_as>
        <field name="module">phpmyfaq</field>
        <field name="event_type">login</field>
        <field name="auth_method">LDAP</field>
        <field name="status">success</field>
        <description>CVE-2026-76208: phpMyFAQ LDAP login succeeded - verify account is not blocked</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>authentication_success,ldap,phpmyfaq,</group>
    </rule>

    <rule id="100763" level="12">
        <if_sid>100762</if_sid>
        <field name="user.status">blocked</field>
        <description>CVE-2026-76208: Blocked account authenticated via LDAP - AUTH BYPASS CONFIRMED</description>
        <group>authentication_success,ldap,phpmyfaq,high,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED status. While the NVD description indicates a fixed version (4.1.7), our tracked patch sources have not yielded concrete evidence of a released patch, a vendor advisory, or a commit reference. Treat this as "vendor-announced fix, not yet independently confirmed." Verify vendor repositories for version 4.1.7 release notes and the specific code changes to AuthLdap::create().

1) Immediate Mitigations (in order of efficacy):

• Disable LDAP authentication on the phpMyFAQ instance if local database authentication is sufficient for your environment. This completely removes the vulnerable code path from reach.
• If LDAP must remain enabled: Implement a network-layer access control list (ACL) restricting access to the phpMyFAQ login page to trusted IP ranges or VPN users only.
• Set up an external detection mechanism: Because the application does not log the status override, deploy a database monitoring agent that watches the account_status column (or the faquser table) for changes from 'blocked' to 'active'. Alert on any such transition.
• Immediately re-block any account that is suspiciously active again: If you detect an account becoming active without administrative action, revert it to 'blocked' and investigate the LDAP authentication logs at the directory level (which are independent of phpMyFAQ's own logs).

2) Patch/Upgrade Steps:

• Immediately test the phpMyFAQ 4.1.7 release in a staging environment once available.
• Review the diff between 4.1.6 and 4.1.7 for changes to AuthLdap.php (the file that likely contains AuthLdap::create()) and related user status management functions.
• Schedule the upgrade to 4.1.7 (or later) in your environment's change window. Given the CVSS score of 8.2 and the unauthenticated nature, upgrade should be treated as urgent.
• After patching: Verify that a blocked LDAP account no longer regains access after a valid LDAP bind.

3) Long-Term Hardening:

• Enable database-level auditing (e.g., MariaDB/MySQL general log or Percona Audit Plugin) for the table containing account_status to ensure no silent privilege modifications occur.
• Implement periodic integrity checks: A nightly cron job that queries for accounts where account_status = 'active' but which are administratively known to be blocked.
• Review phpMyFAQ authentication plugin architecture: Consider contributing a fix to the open-source project that makes the setStatus call conditional on current state, and adds logging for all status transitions.
• Establish a test harness for LDAP auth flows that includes blocked-account scenarios to catch similar regressions in future releases.
• Monitor the phpMyFAQ security mailing list and GitHub releases for related fixes or follow-up advisories.

References

1. NVD Entry (Primary): https://nvd.nist.gov/vuln/detail/CVE-2026-76208 — Official CVE record with CVSS vector, CWE classification, and vulnerability description.
2. phpMyFAQ Official Project: https://www.phpmyfaq.de/ — Vendor project site; monitor for release announcements and the 4.1.7 changelog.
3. phpMyFAQ GitHub Repository: https://github.com/thorsten/phpMyFAQ — Source code repository; inspect tags/diffs between v4.1.6 and v4.1.7 for the fix to AuthLdap::create().
4. CISA Known Exploited Vulnerabilities (KEV): https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Verify current status; as of this report, CVE-2026-76208 is NOT listed.
5. FIRST.org EPSS: https://www.first.org/epss/ — Check for future EPSS scoring of this CVE; not yet scored at time of writing.

Threat Actor Activity: As of the writing date of this report, there is no evidence of active exploitation in the wild, no exploit code published, no Nuclei template available, and no known threat actor campaigns referencing CVE-2026-76208. The vulnerability's requirement for a pre-existing blocked local account with valid LDAP credentials narrows the practical attack surface, which may explain the absence of observed exploitation. Nonetheless, the High CVSS score and the silent nature of the bypass make this a latent risk that should be addressed proactively.