CVE-2023-2429
Improper Access Control in thorsten/phpmyfaq
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Improper Access Control in thorsten/phpmyfaq
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
- Record
CVE-2023-2429- CVSS 3.0
- 6.6 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2023-1387
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
- Record
EUVD-2023-1387- CVSS 3.0
- 6.6 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r69v-q48g-3966
phpMyFAQ Improper Access Control vulnerability
phpMyFAQ prior to version 3.1.13 does not properly validate email addresses when updating user profiles. This vulnerability allows an attacker to manipulate their email address and change it to another email address that is already registered in the system, including email addresses belonging to other users such as the administrator. Once the attacker has control of the other user's email address, they can request to remove the user from the system, leading to a loss of data and access.
- Record
GHSA-r69v-q48g-3966- CVSS 3.0
- 6.6 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
- Record
CVE-2023-2429- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 6.6 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Improper Access Control in thorsten/phpmyfaq
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
- Record
CVE-2023-2429- CVSS 3.0
- 6.6 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-r69v-q48g-3966
phpMyFAQ Improper Access Control vulnerability
phpMyFAQ prior to version 3.1.13 does not properly validate email addresses when updating user profiles. This vulnerability allows an attacker to manipulate their email address and change it to another email address that is already registered in the system, including email addresses belonging to other users such as the administrator. Once the attacker has control of the other user's email address, they can request to remove the user from the system, leading to a loss of data and access.
- Record
GHSA-r69v-q48g-3966- CVSS 3.0
- 6.6 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thorsten/phpmyfaqPackagist |
before 3.1.13 | 3.1.13 |
thorsten/phpmyfaqPackagist |
before 3.1.13, plus listed versions 2.10.0-alpha2.8.02.8.0-RC2.8.0-RC22.8.0-RC3 Show 45 moreShow less2.8.0-RC42.8.0-alpha22.8.0-alpha32.8.0-beta2.8.0-beta22.8.0-beta32.8.12.8.102.8.112.8.122.8.132.8.142.8.152.8.162.8.172.8.182.8.192.8.22.8.202.8.212.8.222.8.232.8.242.8.252.8.262.8.272.8.282.8.292.8.32.8.42.8.52.8.62.8.72.8.82.8.92.9.02.9.0-alpha2.9.0-alpha22.9.0-alpha32.9.0-alpha42.9.0-beta2.9.0-beta22.9.0-rc2.9.0-rc22.9.0-rc3 |
3.1.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-2429 is a medium vulnerability (CVSS 6.6) in Phpmyfaq, published April 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in thorsten/phpmyfaq 3.1.13.
References
huntr.dev/bounties/20d3a0b3-2693-4bf1-b196-10741201a540
github.com/thorsten/phpmyfaq/commit/07552f5577ff8b1e6f7cdefafcce9b2a744d3a24
huntr.com/bounties/20d3a0b3-2693-4bf1-b196-10741201a540
nvd.nist.gov/vuln/detail/CVE-2023-2429
Left out here: 54 versions. The JSON record has them.