Which versions of phpMyFAQ are affected by EUVD-2026-32902?

phpMyFAQ versions before 4.1.3 contain a privilege escalation vulnerability (CVSS 8.7) allowing authenticated low-privilege administrators to hijack SuperAdmin and other administrator accounts,…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-32902?

Yes, a public proof-of-concept exploit is available for EUVD-2026-32902. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-32902?

Within 24 hours: Inventory all phpMyFAQ installations and identify those running versions before 4.1.3; implement temporary restrictions on low-privilege administrator accounts if feasible. Within 7 days: Upgrade all affected phpMyFAQ instances to version 4.1.3 or later. Within 30 days: Audit all administrator account activity and access logs during the exposure window to detect unauthorized account modifications.

phpMyFAQ EUVD-2026-32902

Q: What is the CVSS score of EUVD-2026-32902?

EUVD-2026-32902 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-35671 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-05-28 VulnCheck

GHSA-xvp4-phqj-cjr3

Privilege Escalation Phpmyfaq

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 28, 2026 - 17:01 EUVD

Analysis Updated

May 28, 2026 - 16:36 vuln.today

v3 (cvss_changed)

Analysis Updated

May 28, 2026 - 16:35 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 28, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 28, 2026 - 16:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Source Code Evidence Fetched

May 28, 2026 - 15:54 vuln.today

Analysis Generated

May 28, 2026 - 15:54 vuln.today

DescriptionCVE.org

phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials can escalate to SuperAdmin by modifying the userId parameter in the overwrite-password API request.

AnalysisAI

Privilege escalation in phpMyFAQ before 4.1.3 allows any authenticated low-privilege administrator to take over SuperAdmin (userId=1) or any other account by manipulating the userId parameter in the /admin/api/user/overwrite-password PUT request. The flaw is an insecure direct object reference (IDOR) in the Admin API where authorization checks confirm only that the caller holds the generic USER_EDIT permission, never that the caller is authorized to manage the targeted account. No public exploit identified at time of analysis, but the GHSA advisory from the vendor (thorsten) publicly documents the exact vulnerable code path, making weaponization trivial.

Technical ContextAI

phpMyFAQ is a popular open-source PHP-based FAQ management system maintained by Thorsten Rinne and distributed via Composer (composer/thorsten/phpmyfaq and composer/phpmyfaq/phpmyfaq, per CPE cpe:2.3:a:thorsten:phpmyfaq). The root cause maps to CWE-266 (Incorrect Privilege Assignment): in phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/UserController.php (lines 232-271), the overwritePassword() method calls userHasUserPermission() - which only verifies the generic USER_EDIT capability - and then trusts the client-supplied userId from the JSON body to select which account's password to reset. CSRF is verified, but no horizontal or vertical authorization check confirms the caller is allowed to manage the targeted user or that the target's privilege level is equal or lower than the caller's, so a low-tier admin can pivot to userId=1 (SuperAdmin).

RemediationAI

Vendor-released patch: upgrade phpMyFAQ to version 4.1.3 or later via Composer (thorsten/phpmyfaq or phpmyfaq/phpmyfaq), per GHSA-xvp4-phqj-cjr3 (https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-xvp4-phqj-cjr3). If immediate upgrade is not possible, restrict network access to the /admin path (for example via a reverse proxy ACL, IP allowlist, or VPN-only access) so that only trusted operators can reach the admin API surface - this prevents exploitation but blocks remote admin workflows for legitimate users. As an additional compensating control, audit and reduce the number of accounts holding the USER_EDIT permission and rotate all admin and SuperAdmin passwords after patching, since prior compromise of any admin account is sufficient to have already pivoted to SuperAdmin; note that password rotation alone does not remediate the bug, only upgrading does. Additional context is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/phpmyfaq-insecure-direct-object-reference-in-user-password-api.