CVE-2026-111890
Deferred Deferred - Pending Action

Privilege Escalation in phpMyFAQ via User Rights Update

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111890
EUVD
EUVD-2026-103329

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thorsten phpMyFAQ 4.2.0-alpha.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in phpMyFAQ allows administrators with USER_EDIT privileges to escalate their access by exploiting a flaw in UserController::updateUserRights. When rights are re-granted, language-specific restrictions are removed, granting unrestricted FAQ creation, editing, and publishing across all languages.

Detection Guidance

Check phpMyFAQ user rights configurations for inconsistencies in language-scoped permissions. Review API logs for UserController::updateUserRights requests that modify rights without preserving language restrictions. Inspect user accounts with USER_EDIT privileges for unexpected broad access across languages.

Impact Analysis

An attacker with USER_EDIT privileges could gain full control over FAQ content, bypassing intended language-based restrictions. This could lead to unauthorized modifications, deletions, or publishing of sensitive information across all languages.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating compliance requirements for data integrity and access control in standards like GDPR and HIPAA.

Mitigation Strategies

Update phpMyFAQ to a patched version that preserves language restriction invariants during rights updates. Temporarily revoke USER_EDIT privileges from non-superadmin administrators until patched. Monitor API endpoints for UserController::updateUserRights for suspicious bulk rights modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart