phpMyFAQ EUVD-2026-103326

Exploitation requires an authenticated 'category-restricted' (delegated) administrator account - a privileged but scope-limited role that must already exist in the phpMyFAQ instance. The concrete trigger is an HTTP POST to the /admin/api/group/category-restrictions endpoint supplying categoryIds that are outside the attacker's assigned scope or an empty set, which GroupController::saveCategoryRestrictions() fails to validate against the caller's scope. Limiting factors: the target must run an affected build (4.2.0-alpha before 4.2.0-beta, a pre-release train rarely used in production), delegated/category-restricted administration must be configured and in use, and the attacker must already hold valid admin credentials for that restricted role (PR:H). There is no unauthenticated or anonymous path and no user interaction required (UI:N).

This is a privilege-escalation flaw (CWE-269) in phpMyFAQ that requires an already-privileged account. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N) scores 8.5 (High) and the PR:H metric aligns with the description, which states the actor must be a 'delegated' / 'category-restricted administrator' - i.e., exploitation is authenticated with meaningful pre-existing privileges, not anonymous. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation likelihood signals are absent: no public exploit identified at time of analysis. The high CVSS is driven by HIGH confidentiality and integrity impact (an attacker gains unrestricted category access), but the PR:H gate and the fact that the affected code exists only in a pre-release window (4.2.0-alpha before 4.2.0-beta) substantially lower real-world urgency. Net assessment: a legitimate but lower-priority issue - a high nominal score that is tempered by the privileged-attacker requirement and a pre-release-only affected version. Treat as a hardening/patch item rather than an emergency; absent EPSS/KEV data, do not over-prioritize on CVSS alone.

An organization delegates FAQ administration by giving a department lead a category-restricted administrator account scoped to only their own categories. That delegated admin sends a crafted POST to /admin/api/group/category-restrictions containing out-of-scope or empty categoryIds, causing GroupController::saveCategoryRestrictions() to grant a group unrestricted category access beyond the admin's authorized scope. No public exploit code was identified in the provided data, and the attacker must already hold a valid delegated-admin session (PR:H).