{"id":"CVE-2026-111891","kind":"vulnerability","aliases":["CVE-2026-111891"],"related":[],"title":"phpMyFAQ: group permission API lets scoped admins gain unrestricted access","description":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta has a privilege escalation flaw in its group permission API. A non-superadmin administrator with GROUP_EDIT can grant a group rights they hold only in one language or category, then add themselves to that group and gain unrestricted FAQ create, edit and publish access everywhere.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["php","phpmyfaq","runtime","self-hosted"],"not_affected_if":["default-config","superadmin-only"],"how_to_check":"- Check the installed version of phpMyFAQ, for example in the admin footer or `composer show phpmyfaq/phpmyfaq` if installed by Composer; versions from `4.2.0-alpha.2` up to but not including `4.2.0-beta` are affected.\n- Review which admin accounts hold the GROUP_EDIT right and whether they are non-superadmin users with narrow scopes.","fix":"- Upgrade phpMyFAQ to `4.2.0-beta` or later.\n- Until upgraded, remove the GROUP_EDIT right from non-superadmin administrators.","status":"open","published_at":"2026-10-17T19:16:30+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:38:25+00:00","updated_at":"2026-10-25T03:38:25+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:38:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.2.0-beta` or later.\n- Until upgraded, remove the GROUP_EDIT right from non-superadmin administrators.","reach":"network","title":"phpMyFAQ: group permission API lets scoped admins gain unrestricted access","impact":"medium","summary":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta has a privilege escalation flaw in its group permission API. A non-superadmin administrator with GROUP_EDIT can grant a group rights they hold only in one language or category, then add themselves to that group and gain unrestricted FAQ create, edit and publish access everywhere.","category":"runtime","nicknames":[],"who_cares":["phpmyfaq","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"A scoped admin gains unrestricted FAQ editing and publishing across all content.","analyst_note":"Confirm the exact fixed version and whether the advisory lists a patch or workaround beyond the 4.2.0-beta range, using the NVD entry linked in sources.","how_to_check":"- Check the installed version of phpMyFAQ, for example in the admin footer or `composer show phpmyfaq/phpmyfaq` if installed by Composer; versions from `4.2.0-alpha.2` up to but not including `4.2.0-beta` are affected.\n- Review which admin accounts hold the GROUP_EDIT right and whether they are non-superadmin users with narrow scopes.","needs_analyst":true,"not_affected_if":["default-config","superadmin-only"],"who_is_affected":"Installations running phpMyFAQ 4.2.0-alpha.2 up to 4.2.0-beta, where some administrators hold GROUP_EDIT without full superadmin rights. Installations with only superadmin users holding group management rights are exposed less, since the exploit depends on a scoped administrator. Sites on earlier or later releases are not in the stated range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":3406,"output_tokens":730,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111891':13A,16A '-2026':12A,15A '4.2.0':25B,28B,79C,82C 'access':10A,75B,148C 'across':149C 'add':62B 'admin':7A 'administr':44B,117C 'alpha.2':26B,80C 'api':4A,39B,93C 'beta':29B,83C 'categori':60B,107C,153C 'check':99C 'contain':84C 'creat':71B,144C 'cve':11A,14A 'edit':47B,72B,120C,145C 'endpoint':98C 'escal':33B,87C 'everywher':76B 'faq':70B,143C 'flaw':34B 'gain':8A,68B,141C 'grant':49B,113C,122C 'group':2A,37B,46B,51B,66B,91C,112C,119C,124C 'held':100C 'hold':54B,118C,128C 'host':22B 'join':137C 'languag':58B,105C,151C 'let':5A 'narrow':132C 'non':42B,115C 'non-superadmin':41B,114C 'one':57B 'permiss':3A,38B,92C 'php':17B 'phpmyfaq':1A,18B,23B,77C 'privileg':32B,86C 'publish':74B,147C 'regard':103C 'right':52B,101C,126C 'runtim':19B 'scope':6A,108C,133C 'self':21B,136C 'self-host':20B 'self-join':135C 'superadmin':43B,116C 'unrestrict':9A,69B,111C,142C 'updatememb':97C,140C 'updatepermiss':95C 'via':139C 'vulner':88C 'whose':94C 'without':102C 'write':110C","nicknames":[],"mitigations":[],"who_affected":"Installations running phpMyFAQ 4.2.0-alpha.2 up to 4.2.0-beta, where some administrators hold GROUP_EDIT without full superadmin rights. Installations with only superadmin users holding group management rights are exposed less, since the exploit depends on a scoped administrator. Sites on earlier or later releases are not in the stated range.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111891","severity":null,"published_at":"2026-10-17T19:16:30+00:00","modified_at":"2026-10-19T17:17:05+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}