CVE-2026-111893: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated delegated administrator whose permissions are restricted to specific categories can exploit it. The attack requires high privileges, but not access to categories outside the administrator's assigned scope.
What access does an attacker need?
The attacker needs to be able to send a POST request to /admin/api/group/category-restrictions. They can submit out-of-scope categoryIds, or empty categoryIds, to change a group's category access.
What is the impact of submitting empty categoryIds?
Submitting empty categoryIds can grant the targeted group unrestricted access to categories. This allows a category-restricted administrator to expand group access beyond the categories they are authorized to manage.
Which releases are affected?
The affected range is phpMyFAQ 4.2.0-alpha before 4.2.0-beta. The provided information does not identify other affected versions or a separate mitigation.