phpMyFAQ CVE-2026-111891

Requires an authenticated non-superadmin administrator account that holds the GROUP_EDIT right (PR:H). The flaw lives specifically in the group permission API's updatePermissions and updateMembers endpoints, which validate held rights without checking language or category scope and then write unrestricted group grants. Exploitation is only meaningful in deployments that use delegated/scoped administration - i.e., where lower-tier admins are intentionally limited to specific languages or categories; a single-superadmin installation offers no privileges to escalate from. Limiting factors: attacker must already possess GROUP_EDIT, superadmin is not required but a scoped admin account is, and only phpMyFAQ builds from 4.2.0-alpha.2 up to (not including) 4.2.0-beta are affected.

This is a moderate-severity, authenticated privilege-escalation flaw (CVSS 4.0 base 7.0) whose real-world risk is tempered by its PR:H prerequisite. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) confirms the attacker must already hold high privileges - specifically a non-superadmin administrator account with the GROUP_EDIT right - so this is an insider or post-compromise escalation path, not a remote-unauthenticated breach. Impact is skewed toward integrity (VI:H: unrestricted FAQ create/edit/publish across all languages and categories) with only low confidentiality (VC:L) and no availability impact. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so exploitation status is: no public exploit identified at time of analysis. The signals are internally consistent - there is no conflict between the network attack vector and the described web-API exploitation, since the GROUP_EDIT administrator reaches the vulnerable updatePermissions/updateMembers endpoints over HTTP. Net: a credible but conditional risk that matters most in multi-tenant or delegated-administration phpMyFAQ deployments where lower-tier admins are deliberately scoped to narrow language/category permissions; in single-superadmin installations the practical exposure is minimal. Missing EPSS and absence from KEV suggest this is not under active or widespread exploitation.

A multi-author phpMyFAQ site delegates content administration by giving a department admin the GROUP_EDIT right scoped to a single language or category. That admin calls the updatePermissions endpoint to grant a group a right they only legitimately hold in that narrow scope, then uses updateMembers to add their own account to that group, obtaining unrestricted FAQ create, edit, and publish access across every language and category. No public exploit code is identified at time of analysis, though the attack requires only standard authenticated API calls over the network (AV:N/AC:L).