Security Advisory 2025-10-03

Duplicate email registration allows multiple accounts with the same email in phpMyFAQ

The phpMyFAQ Team has learned of a security issue that'd been discovered in phpMyFAQ 4.0.12 and

earlier. It's possible to create duplicate email registration allows multiple accounts with the same email in phpMyFAQ.

Due to insufficient validation of email addresses during the user registration process,

it is possible to register multiple user accounts using the same email address.

This vulnerability can lead to confusion in user management, potential unauthorized access to user-specific features,

and complications in password recovery processes.

The phpMyFAQ Team has released the new phpMyFAQ version 4.0.13, which fixes the vulnerability. All

users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.

There's no workaround except installing phpMyFAQ 4.0.13.

The phpMyFAQ team would like to thank halas98 for the

responsible disclosures of this vulnerability.