Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-57995

phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full administrative control.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

phpMyFAQ phpMyFAQ

Default version status: unaffected

  • 0 to < 4.1.5affected
  • 4.1.5unaffected

References