CVE-2026-66399: phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership
phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding user-management rights and immediately inherit those permissions to modify or delete user accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.6 - Compensating control
Restrict access to phpMyFAQ group-management functionality so that only fully authorized administrators can manage group membership that grants user-management rights.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66399?
The severity of CVE-2026-66399 is medium with a score of 6.5.
How do I fix CVE-2026-66399?
To fix CVE-2026-66399, upgrade phpMyFAQ to version 4.1.6 or later.
What is the impact of CVE-2026-66399?
CVE-2026-66399 allows attackers to escalate privileges by gaining unauthorized access to privileged groups.
Who is affected by CVE-2026-66399?
Users of phpMyFAQ versions prior to 4.1.6 are affected by CVE-2026-66399.
What is the nature of the vulnerability in CVE-2026-66399?
CVE-2026-66399 is a privilege escalation vulnerability related to improper verification of group memberships.