EUVD-2026-40454
GHSA-996g-x95h-p2f5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remotely reachable admin function (AV:N/AC:L), needs an existing GROUP_EDIT admin account so PR:L, no user interaction, and full app compromise gives C/I/A:H with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full administrative control.
AnalysisAI
Privilege escalation in phpMyFAQ before 4.1.5 lets a delegated administrator holding the GROUP_EDIT right elevate to full administrative control. Because GroupController::updatePermissions never verifies that the caller already possesses the permissions being assigned, a low-privileged admin can grant high-value rights to a group they belong to and inherit those rights. The flaw was reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
phpMyFAQ is an open-source PHP-based FAQ/knowledge-base application with a role- and group-based permission model where administrators can be delegated narrow capabilities such as GROUP_EDIT. The root cause is CWE-269 (Improper Privilege Management): the updatePermissions handler in GroupController applies whatever permission set is submitted for a group without enforcing a self-rights constraint - i.e. it does not check that the acting administrator currently holds each right they are attempting to assign. Permissions in phpMyFAQ are effectively transitive through group membership, so any right written onto a group is inherited by its members, turning a missing authorization check into a direct path to higher privilege.
RemediationAI
Vendor-released patch: phpMyFAQ 4.1.5 - upgrade to 4.1.5 or later as the primary fix, per the GHSA advisory (https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pg62-f8g4-4wqh). If immediate upgrade is not possible, reduce exposure by revoking the GROUP_EDIT right from all delegated/non-trusted administrators so that group-permission editing is restricted to fully trusted super-admins (trade-off: removes legitimate delegated group management until patched), and audit existing group permission assignments for unexpected high-value rights that may indicate prior abuse. Restricting admin-panel access to a trusted network segment or VPN further limits who can reach the vulnerable controller, at the cost of remote administrative convenience.
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated high severity (CVSS 8.8), th
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today