---
id: "CVE-2026-111891"
kind: "vulnerability"
aliases: ["CVE-2026-111891"]
title: "phpMyFAQ: group permission API lets scoped admins gain unrestricted access"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["php", "phpmyfaq", "runtime", "self-hosted"]
not_affected_if: ["default-config", "superadmin-only"]
published_at: "2026-10-17T19:16:30+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:38:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111891", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# phpMyFAQ: group permission API lets scoped admins gain unrestricted access

phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta has a privilege escalation flaw in its group permission API. A non-superadmin administrator with GROUP_EDIT can grant a group rights they hold only in one language or category, then add themselves to that group and gain unrestricted FAQ create, edit and publish access everywhere.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of phpMyFAQ, for example in the admin footer or `composer show phpmyfaq/phpmyfaq` if installed by Composer; versions from `4.2.0-alpha.2` up to but not including `4.2.0-beta` are affected.
- Review which admin accounts hold the GROUP_EDIT right and whether they are non-superadmin users with narrow scopes.

## Fix

- Upgrade phpMyFAQ to `4.2.0-beta` or later.
- Until upgraded, remove the GROUP_EDIT right from non-superadmin administrators.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111891

## From the sources

phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_