CVE-2026-111891: phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUPEDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
Who can exploit this issue?
A non-superadmin administrator who holds the GROUP_EDIT permission can exploit it. The administrator must also hold a right in at least a narrow language or category scope that they can assign to a group.
What access does successful exploitation provide?
The attacker can grant unrestricted permissions to a group and add themselves as a member through the group permission API. This can result in unrestricted FAQ creation, editing, and publishing across all languages and categories.
Which versions are affected?
The affected range begins with phpMyFAQ 4.2.0-alpha.2 and ends before phpMyFAQ 4.2.0-beta.