CVE-2026-111891
Deferred Deferred - Pending Action

Privilege Escalation in phpMyFAQ via Group Permission API

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111891
EUVD
EUVD-2026-103328

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thorsten phpMyFAQ 4.2.0-alpha.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a privilege escalation flaw in phpMyFAQ versions 4.2.0-alpha.2 to 4.2.0-beta. Non-superadmin administrators with GROUP_EDIT permission can exploit the group permission API endpoints (updatePermissions and updateMembers) to bypass language and category scope restrictions. They can grant themselves unrestricted FAQ create, edit, and publish access across all languages and categories by widening their rights from a narrow scope to a global scope.

Detection Guidance

To detect this vulnerability, inspect phpMyFAQ installations for versions between 4.2.0-alpha.2 and 4.2.0-beta. Check GroupController endpoints updatePermissions and updateMembers for improper scope validation in group permission APIs.

Impact Analysis

An attacker with GROUP_EDIT privileges could gain full control over the FAQ knowledge base, allowing unauthorized creation, modification, or deletion of content. This could lead to misinformation, data tampering, or disruption of services relying on the FAQ system. The impact is high integrity due to unauthorized data changes.

Compliance Impact

This vulnerability could lead to unauthorized data modification, violating integrity requirements in GDPR and HIPAA. Unrestricted access to FAQ content may result in the exposure or alteration of sensitive information, potentially breaching compliance with data protection and privacy regulations.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.2.0-beta or later to apply the fix for scope-aware checks in group permission APIs. Remove GROUP_EDIT permissions from non-superadmin administrators until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111891. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart