CVE-2026-111890: phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USEREDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated administrator who holds the USER_EDIT permission can exploit it. That administrator can submit language-scoped rights through the update-rights API, including when modifying their own rights.
What access can an attacker gain?
The flaw can turn language-scoped FAQ permissions into unrestricted access across all languages. The affected permissions include creating, editing, and publishing FAQs.
Which versions are affected?
phpMyFAQ versions from 4.2.0-alpha.2 up to, but not including, 4.2.0-beta are affected.