Which versions of phpMyFAQ are affected by CVE-2026-56396?

phpMyFAQ before version 4.1.4 allows administrators to escalate their privileges to SuperAdmin, enabling complete unauthorized control of the FAQ system.. A patch is available.

How to fix or mitigate CVE-2026-56396?

Within 24 hours: Audit all phpMyFAQ SuperAdmin accounts and review user permission modification logs for unauthorized privilege changes; no public exploit identified at time of analysis, but this vulnerability affects authenticated administrators with user-management permissions. Within 7 days: Upgrade phpMyFAQ to version 4.1.4 or later and restrict user-management permissions to only senior administrators. Within 30 days: Deploy monitoring and alerting for unauthorized privilege escalation attempts and conduct comprehensive audit of administrative role assignments.

phpMyFAQ CVE-2026-56396

Q: What is the CVSS score of CVE-2026-56396?

CVE-2026-56396 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38162 HIGH

Missing Authorization (CWE-862)

2026-06-21 VulnCheck

GHSA-q82q-6rfm-h9vp

Authentication Bypass Phpmyfaq

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web endpoint (AV:N), no special conditions (AC:L), requires an authenticated admin with edit_user (PR:L), no victim interaction (UI:N); full app takeover gives C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 07:50 vuln.today

Patch available

Jun 21, 2026 - 15:31 EUVD

DescriptionCVE.org

phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or grant arbitrary rights to escalate to SuperAdmin access.

AnalysisAI

Privilege escalation in phpMyFAQ before 4.1.4 allows authenticated non-SuperAdmin users holding the edit_user permission to promote themselves to SuperAdmin via missing authorization checks in the editUser() and updateUserRights() endpoints. The flaw lets a low-tier administrator set the is_superadmin flag or grant arbitrary rights, fully compromising the FAQ application; publicly available exploit code exists is not asserted, and at time of analysis no public exploit identified at time of analysis.

Technical ContextAI

phpMyFAQ is a PHP-based FAQ/knowledge-base web application that supports a multi-tier permissions model distinguishing standard users, group administrators, and SuperAdmins. The root cause is CWE-862 (Missing Authorization): the editUser() and updateUserRights() handlers verify only that the caller holds the generic edit_user permission, but never re-check that the caller is itself a SuperAdmin before allowing the is_superadmin attribute or arbitrary right assignments to be written. Per the CPE cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:* the issue affects all phpMyFAQ branches prior to 4.1.4.

RemediationAI

Vendor-released patch: phpMyFAQ 4.1.4 - upgrade immediately per the GitHub Security Advisory at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-985r-q3qp-299h. Until the upgrade can be deployed, revoke the edit_user permission from all accounts other than trusted SuperAdmins so the vulnerable editUser() and updateUserRights() endpoints cannot be reached by lower-tier admins (side effect: delegated user management workflows will break and SuperAdmins must handle account changes). Additionally, audit the users table for unexpected is_superadmin=1 rows or anomalous rights grants made before patching, and restrict network access to the phpMyFAQ admin path (/admin) to known operator IPs as defence in depth (side effect: remote admin work requires VPN).