phpMyFAQ CVE-2026-57996

The attacker must already possess an authenticated phpMyFAQ administrator account carrying the USER_ADD/EDIT/DELETE permissions (a delegated, non-SuperAdmin role) and network access to the /admin API. The concrete trigger is a POST /admin/api/user/add request that includes the field isSuperAdmin: true along with attacker-chosen credentials, which the endpoint honors due to the missing SuperAdmin guard. Limiting factors: exploitation is not possible for unauthenticated users or for admins lacking user-management rights, so the realistic risk is bounded to insiders or to attackers who have already stolen a mid-tier admin session/credential.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects network reachability, low attack complexity, no user interaction, and high impact to confidentiality, integrity, and availability, gated only by PR:L - the attacker must already hold a delegated admin account with user-management permissions. That precondition meaningfully narrows the threat to insiders or attackers who have already compromised a mid-tier admin credential, so this is an escalation primitive rather than an unauthenticated internet-wide risk. No EPSS score, KEV listing, or POC was provided, so real-world exploitation frequency cannot be quantified from the input; the SSVC signals (automatable, exploitation status) are likewise absent. Net: a genuine, high-impact issue where a compromised or malicious sub-admin trivially becomes SuperAdmin, but the PR:L barrier makes it a targeted/insider-weighted priority rather than a mass-exploitation candidate.

A contractor or help-desk operator granted a delegated phpMyFAQ admin role with user-management rights sends a single authenticated POST to /admin/api/user/add with isSuperAdmin set to true and a username/password they control. The server creates the SuperAdmin account without checking the caller's own tier, and the attacker logs in with those credentials to gain full control of the instance, its content, and its stored user data. No public exploit was identified at time of analysis, but the attack is a straightforward crafted API request over the network.