EUVD-2026-40454
GHSA-996g-x95h-p2f5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as GROUP_EDIT delegated admin
-
DeliveryOpen group permissions editor
-
ExploitSubmit updatePermissions assigning admin rights to own group
-
ExecutionServer skips self-rights check
-
PersistInherit elevated rights via group membership
-
ImpactFull administrative control of phpMyFAQ
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated phpMyFAQ administrator who holds the GROUP_EDIT permission (PR:L) and is a member of, or can target, a group whose permissions they can edit; the attacker then assigns rights they do not themselves possess via the GroupController::updatePermissions handler. There is no requirement for user interaction (UI:N) or special attack conditions (AT:N), and the admin interface must be network-reachable (AV:N). The principal limiting factor is that fully locked-down deployments which never delegate the GROUP_EDIT right to less-trusted accounts are not practically exploitable, since a full super-admin already has the privileges this flaw would grant. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC/VI/VA:H, score 8.7) describes a network-exploitable, low-complexity attack requiring an existing low-privileged authenticated account (the GROUP_EDIT delegated admin) and yielding full confidentiality, integrity, and availability impact on the application - consistent with complete admin takeover. The PR:L requirement is the principal limiting factor: this is not an anonymous internet attack but an insider/over-delegation escalation, so realistic risk concentrates in deployments that actually hand out partial admin rights. No EPSS score, SSVC decision, or KEV entry was provided, and no POC is referenced; absence of those signals plus the authentication prerequisite suggests this is a meaningful but not mass-exploited issue. There is no conflict between the vector and description - both point to an authenticated, remotely reachable privilege-escalation primitive. |
| Exploit ScenarioDerived | A company grants a help-desk lead a phpMyFAQ admin account limited to the GROUP_EDIT capability for managing FAQ author groups. That user opens the group-permissions editor, assigns full administrative rights to a group they are a member of, and reloads - inheriting super-admin control over the entire knowledge base. No public POC is referenced, but the attack needs only the existing low-privileged session and a single crafted permission-update request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 30, 2026
Privilege escalation in phpMyFAQ before 4.1.5 lets a delegated administrator holding the GROUP_EDIT right elevate to full administrative control. Because GroupController::updatePermissions never verifies that the caller already possesses the permissions being assigned, a low-privileged admin can grant high-value rights to a group they belong to and inherit those rights. The flaw was reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: phpMyFAQ 4.1.5 - upgrade to 4.1.5 or later as the primary fix, per the GHSA advisory (https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pg62-f8g4-4wqh). If immediate upgrade is not possible, reduce exposure by revoking the GROUP_EDIT right from all delegated/non-trusted administrators so that group-permission editing is restricted to fully trusted super-admins (trade-off: removes legitimate delegated group management until patched), and audit existing group permission assignments for unexpected high-value rights that may indicate prior abuse. Restricting admin-panel access to a trusted network segment or VPN further limits who can reach the vulnerable controller, at the cost of remote administrative convenience.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
phpMyFAQ is an open-source PHP-based FAQ/knowledge-base application with a role- and group-based permission model where administrators can be delegated narrow capabilities such as GROUP_EDIT. The root cause is CWE-269 (Improper Privilege Management): the updatePermissions handler in GroupController applies whatever permission set is submitted for a group without enforcing a self-rights constraint - i.e. it does not check that the acting administrator currently holds each right they are attempting to assign. Permissions in phpMyFAQ are effectively transitive through group membership, so any right written onto a group is inherited by its members, turning a missing authorization check into a direct path to higher privilege.
Know when Phpmyfaq gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remotely reachable admin function (AV:N/AC:L), needs an existing GROUP_EDIT admin account so PR:L, no user interaction, and full app compromise gives C/I/A:H with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full administrative control.
Executive ViewAI
phpMyFAQ versions before 4.1.5 contain a privilege escalation vulnerability (CVSS 8.7) allowing authenticated administrators with GROUP_EDIT permissions to escalate to full administrative control. No public exploit has been identified at time of analysis. Organizations using phpMyFAQ face insider threat risk, as delegated administrators could gain unrestricted system access, potentially enabling unauthorized FAQ modification, data exposure, or system reconfiguration.
No vendor-released patch identified at time of analysis. Interim mitigations: minimize GROUP_EDIT role assignment to trusted personnel only, enable detailed audit logging and real-time alerting for group permission changes, conduct monthly access reviews of delegated administrators, implement change approval workflows for sensitive permission modifications, and consider network segmentation for phpMyFAQ administrative interfaces.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Duplicate-email registration handling in phpMyFAQ 4.0.7 through 4.0.13 (and 4.0-nightly-2025-10-03 and earlier) lets una
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
Exploit-DB