Live › vulnerability › CVE-2026-111891
Go to dashboardphpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta has a privilege escalation flaw in its group permission API. A non-superadmin administrator with GROUP_EDIT can grant a group rights they hold only in one language or category, then add themselves to that group and gain unrestricted FAQ create, edit and publish access everywhere.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations running phpMyFAQ 4.2.0-alpha.2 up to 4.2.0-beta, where some administrators hold GROUP_EDIT without full superadmin rights. Installations with only superadmin users holding group management rights are exposed less, since the exploit depends on a scoped administrator. Sites on earlier or later releases are not in the stated range.
No product ranges from the sources yet.
composer show phpmyfaq/phpmyfaq if installed by Composer; versions from 4.2.0-alpha.2 up to but not including 4.2.0-beta are affected.4.2.0-beta or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.
This page as .md · .json · in your agent: get_signal("CVE-2026-111891")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.