phpMyFAQ: session-only auth downgrade, password change without verification, and TOTP secret in data export

TL;DR

Three distinct auth issues in phpMyFAQ convert any session foothold into full account takeover, and leak the live TOTP seed via the GDPR export. The vendor assigned CVEs: CVE-2026-85590 (2FA removal without step-up), CVE-2026-85591 (unverified password change), CVE-2026-85588 (TOTP seed in export). Related admin-API authorization misses and UI permission mixups were tracked separately.

Target & scope

Verified on main @ 9435f34 (4.2.0-alpha.2) and 4.1 stable for the TOTP/export and password-change paths.

Root causes

POST /api/user/remove-twofactor and the inline twofactor_enabled toggle require only session + CSRF; no password re-entry and no current TOTP code.
PUT /api/user/data/update accepts a new password with only CSRF+session and length checks; no password_verify() of the current password.
exportUserData() includes 'secret' => ... — the raw TOTP seed — in userdata.json inside the export ZIP.

Exploitation

evidence — Unverified password change

PUT /api/user/data/update
Cookie: PMFSESSID=...
Body: pmf-csrf-token=T&faqpassword=NewStrong#1&faqpassword_confirm=NewStrong#1
=> password updated; existing sessions invalidated

Remediation

Require step-up auth for security-sensitive actions: demand current password or a valid current TOTP code to disable 2FA or change password.
For exports, never include live credential material; if needed, include a boolean and recovery timestamp, not the seed.

Disclosure timeline

date (UTC)	event
2026-08-12	found
2026-08-13	reported via GitHub PVR (six issues total)
2026-09-04	CVEs assigned/published

Artifacts

CVE-2026-85590 — https://nvd.nist.gov/vuln/detail/CVE-2026-85590
CVE-2026-85591 — https://nvd.nist.gov/vuln/detail/CVE-2026-85591
CVE-2026-85588 — https://nvd.nist.gov/vuln/detail/CVE-2026-85588