CVE-2026-76208
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-76208 is a high-severity Insufficient Logging (CWE-778) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AU-12 (Audit Record Generation) and AU-2 (Event Logging) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-62449
Vulnerability Data
phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus('active') unconditionally, which overwrites the account_status column of a pre-existing local account from 'blocked' to…
more
'active'. As a result, a user whose local phpMyFAQ account has been administratively blocked can restore their account and log in by authenticating via LDAP. The state transition is not logged, so administrators cannot detect that the block was overridden. Fixed in 4.1.7.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 11 hardening rules · 4 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
AU-12 requires the system to generate audit records for defined events, structurally eliminating the root condition of insufficient logging.
AU-2 requires identification and logging of security-relevant event types, directly stopping omission of critical events.
AU-3 mandates that audit records contain the specific details needed to understand what occurred, preventing incomplete event descriptions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Insufficient logging directly prevents generation of the incident data/metadata that RS.AN-07 requires, so the weakness starves collection/preservation completely in both directions.
Insufficient logging largely blinds event analysis by omitting the critical details needed to understand adverse activities.
Insufficient logging starves the multiple log sources and SIEM correlation that DE.AE-03 relies on, largely defeating its ability to operate while the logging gap removes most of the correlation outcome's value.
Insufficient logging starves impact/scope estimation of the event details required to produce accurate estimates, removing most of the outcome's value while leaving limited non-log avenues intact.
Insufficient logging starves DE.AE-06 of the event data that must be delivered to staff/tools, removing most of the outcome's value while the delivery mechanisms themselves remain intact.
Insufficient logging starves incident declaration of the event details needed to evaluate criteria, removing most of the outcome's efficacy in both directions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandating comprehensive event logging with user IDs, timestamps, and access attempts directly eliminates the absence of audit trails that would otherwise allow undetected exploitation.
Mandating retention of monitoring records and real-time or periodic logging directly counters insufficient logging by ensuring security-relevant events are captured.
Trustworthy timestamps ensure that security-relevant events are recorded with accurate chronology, improving the usefulness of logs for detecting and investigating incidents.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248726 The OL 8 System must take appropriate action when an audit processing failure occurs. prevents CWE-778
- V-248728 The OL 8 audit system must take appropriate action when the audit storage volume is full. prevents CWE-778
Oracle Linux 9 (1 rule)
- V-271579 OL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs. prevents CWE-778
RHEL 8 (4 rules)
- V-230390 The RHEL 8 System must take appropriate action when an audit processing failure occurs. prevents CWE-778
- V-230439 Successful/unsuccessful uses of the rename, unlink, rmdir, renameat, and unlinkat system calls in RHEL 8 must generate an audit record. prevents CWE-778
- V-230455 Successful/unsuccessful uses of the chown, fchown, fchownat, and lchown system calls in RHEL 8 must generate an audit record. prevents CWE-778
RHEL 9 (1 rule)
- V-258153 RHEL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs. prevents CWE-778