Live › vulnerability › CVE-2026-111890
Go to dashboardphpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta drops per-right language restrictions when user rights are re-granted through UserController::updateUserRights. An administrator holding USER_EDIT can submit language-scoped rights to the update-rights API, including for their own account, and gain unrestricted FAQ create, edit and publish access in every language.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations running phpMyFAQ 4.2.0-alpha.2 up to but not including 4.2.0-beta are exposed. The risk sits with accounts that hold USER_EDIT, since those are the accounts that can reach the rights-update API; sites with no such accounts beyond a single trusted admin face little added risk. Sites already on 4.2.0-beta or later are not affected.
No product ranges from the sources yet.
composer show phpmyfaq/phpmyfaq and see whether it falls in 4.2.0-alpha.2 up to 4.2.0-beta4.2.0-beta or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.
This page as .md · .json · in your agent: get_signal("CVE-2026-111890")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.