phpMyFAQ EUVD-2026-103329

Exploitation requires an authenticated administrator account holding the USER_EDIT right (PR:H), and specifically targets accounts whose FAQ rights are currently language-scoped/restricted. The trigger is submitting a language-scoped rights update through phpMyFAQ's update-rights API (UserController::updateUserRights), including against the attacker's own account; the flawed re-grant logic then discards the per-right language restriction. Limiting factors: the attacker must already be a trusted operator with USER_EDIT, no anonymous or low-privilege path exists, and the affected code is confined to the 4.2.0-alpha.2-through-pre-4.2.0-beta development line, so stable/released installations outside that range are not affected. Upgrading to 4.2.0-beta or later removes the condition.

This is a genuine but access-gated privilege escalation (CWE-269) that is likely moderate priority rather than an emergency. The only severity signal present is the vendor/CVSS 4.0 vector (7.0) of CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N: network-reachable API, low attack complexity, no user interaction, but high privileges required (PR:H) - the attacker must already be an administrator holding USER_EDIT. The high-integrity impact (VI:H) reflects that a constrained, language-scoped admin can self-grant unrestricted FAQ create/edit/publish rights across all languages, i.e. a vertical escalation within the admin tier rather than a jump from anonymous to admin. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no evidence of active exploitation or automatable mass abuse; the SSVC-style read is low-urgency (no exploitation observed, not internet-wormable given the PR:H precondition). The PR:H requirement is the dominant limiting factor: an attacker who already holds USER_EDIT is a trusted operator, so the practical threat is insider abuse or a compromised admin account, not opportunistic internet scanning. Signals are internally consistent - no CVSS-vs-description conflict - but note the input provides a CVSS 4.0 vector only, with no CVSS 3.1 vector, no EPSS, and no POC flag to corroborate exploitability.

An administrator (or hijacked admin session) who holds the USER_EDIT right but whose own FAQ rights are language-restricted submits a language-scoped rights update via the update-rights API, targeting their own account. Because updateUserRights drops the per-right language restriction when rights are re-granted, the operator ends up with unrestricted create, edit, and publish rights across every language. No public exploit code is identified at time of analysis; exploitation requires an authenticated session at the USER_EDIT privilege level.