Which versions of phpMyFAQ are affected by CVE-2026-57996?

phpMyFAQ versions before 4.1.5 contain a privilege escalation vulnerability that allows delegated administrators with user-management rights to create unauthorized SuperAdmin accounts, resulting in…. A patch is available.

How to fix or mitigate CVE-2026-57996?

Within 24 hours: inventory all phpMyFAQ deployments, confirm installed versions, and immediately restrict network access to the /admin/api/user/add endpoint to a minimal set of trusted administrators using firewall or reverse-proxy rules. Within 7 days: audit security logs for any unexpected SuperAdmin account creations within the past 90 days, reset credentials for all delegated administrators holding user-management permissions, and enable real-time alerting for SuperAdmin account creation events. Within 30 days: monitor the phpMyFAQ project repository for release of version 4.1.5 or later, then schedule and execute an upgrade to the patched release across all production phpMyFAQ instances.

phpMyFAQ CVE-2026-57996

Q: What is the CVSS score of CVE-2026-57996?

CVE-2026-57996 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-44632 HIGH

Improper Privilege Management (CWE-269)

2026-07-15 VulnCheck

GHSA-26xw-7hf2-f34q

Privilege Escalation Phpmyfaq

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Remotely reachable admin API with low complexity and no user interaction, but requires an existing delegated-admin account (PR:L); full SuperAdmin takeover gives high C/I/A within the same instance (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 13:03 EUVD

Analysis Generated

Jul 15, 2026 - 12:27 vuln.today

CVE Published

Jul 15, 2026 - 11:25 cve.org

HIGH 8.7

DescriptionCVE.org

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin accounts. A delegated administrator with USER_ADD/EDIT/DELETE permissions can call POST /admin/api/user/add with isSuperAdmin: true and attacker-chosen credentials to create a SuperAdmin account, then authenticate as that account to achieve full instance takeover.

AnalysisAI

Privilege escalation in phpMyFAQ before 4.1.5 lets a delegated administrator holding USER_ADD/EDIT/DELETE rights mint a full SuperAdmin account through the POST /admin/api/user/add endpoint, resulting in complete instance takeover. The flaw stems from a missing SuperAdmin authorization guard, allowing a lower-privileged operator to submit isSuperAdmin: true with attacker-chosen credentials and then log in as that account. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

phpMyFAQ is a PHP-based, self-hosted FAQ/knowledge-base application with a role-based admin panel that distinguishes ordinary (delegated) administrators from SuperAdmins. The vulnerability is classified CWE-269 (Improper Privilege Management): the user-creation API path (/admin/api/user/add) trusts the caller-supplied isSuperAdmin flag without verifying that the requester is itself a SuperAdmin. The CPE cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:* confirms the application (not a plugin) is affected, across all versions prior to 4.1.5. Because SuperAdmin is the highest trust tier in phpMyFAQ, the missing guard collapses the privilege boundary between delegated admins and full instance owners.

RemediationAI

Upgrade to phpMyFAQ 4.1.5 or later, which adds the missing SuperAdmin authorization check on the user/add endpoint (Vendor-released patch: 4.1.5); see the GitHub Security Advisory GHSA-r2f4-v277-hvw9 at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-r2f4-v277-hvw9. If immediate patching is not possible, tightly restrict which accounts hold USER_ADD/EDIT/DELETE permissions and remove those rights from any non-trusted delegated administrators, since those permissions are the exploitation prerequisite; this trades away delegated user-management convenience. Additionally, monitor the admin API for POST /admin/api/user/add requests containing isSuperAdmin: true and audit the SuperAdmin account list for unexpected additions, accepting that this is detective rather than preventive. Consider network-restricting access to /admin to trusted management IPs to shrink exposure of the admin API surface.