Live › vulnerability › CVE-2026-111893
Go to dashboardphpMyFAQ 4.2.0-alpha before 4.2.0-beta lets delegated administrators assign categories outside their own scope through the group category restrictions endpoint. A restricted admin can post out-of-scope or empty category IDs to grant groups unrestricted access to categories they should not control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations running phpMyFAQ 4.2.0-alpha before 4.2.0-beta that use delegated, category-restricted administrator accounts. Installations without delegated category-restricted admins have a much smaller exposure, and sites on later versions are not affected.
No product ranges from the sources yet.
4.2.0-alpha up to but not including 4.2.0-beta are affected.4.2.0-beta or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.
This page as .md · .json · in your agent: get_signal("CVE-2026-111893")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.