How to fix or mitigate CVE-2026-66399?

Within 24 hours, restrict group-management administrator permissions to only trusted personnel and enable logging of all group membership changes. Within 7 days, conduct a full audit of existing administrative accounts and group memberships, and implement role-based access controls to enforce separation of duties. Within 30 days, if no vendor patch is available, consider deploying additional manual approval workflows for any group membership modifications, or isolate phpMyFAQ instances with higher security requirements.

GroupController CVE-2026-66399

Q: What is the CVSS score of CVE-2026-66399?

CVE-2026-66399 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

Q: Which versions of GroupController are affected by CVE-2026-66399?

A privilege escalation vulnerability in phpMyFAQ versions before 4.1.6 allows administrators with only group-management permissions to improperly escalate their access by adding themselves to groups…. A patch is available.

EUVD-2026-49332 HIGH

Improper Privilege Management (CWE-269)

2026-07-27 disclosure@vulncheck.com

GHSA-5w7v-f8fx-865c

Privilege Escalation

8.5

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 27, 2026 - 17:02 EUVD

Analysis Generated

Jul 27, 2026 - 16:33 vuln.today

CVE Published

Jul 27, 2026 - 16:18 cve.org

HIGH 8.5

DescriptionCVE.org

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding user-management rights and immediately inherit those permissions to modify or delete user accounts.

AnalysisAI

Privilege escalation in phpMyFAQ before 4.1.6 allows administrators with only group-management permissions to add themselves to existing groups holding user-management rights without verification of required privileges, enabling unauthorized modification or deletion of user accounts. The vulnerability stems from missing authorization checks in GroupController::updateMembers(). No public exploit or active exploitation has been identified at the time of analysis.