EUVD-2026-49332
GHSA-5w7v-f8fx-865c
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Privilege escalation in phpMyFAQ before 4.1.6 allows administrators with only group-management permissions to add themselves to existing groups holding user-management rights without verification of required privileges, enabling unauthorized modification or deletion of user accounts. The vulnerability stems from missing authorization checks in GroupController::updateMembers(). No public exploit or active exploitation has been identified at the time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding user-management rights and immediately inherit those permissions to modify or delete user accounts.
Executive ViewAI
A privilege escalation vulnerability in phpMyFAQ versions before 4.1.6 allows administrators with only group-management permissions to improperly escalate their access by adding themselves to groups with user-management rights. This could lead to unauthorized modification or deletion of user accounts, impacting the integrity of user data and organizational trust. Leadership should ensure immediate review of administrative privileges and implement monitoring controls until a patch is available.
Within 24 hours, restrict group-management administrator permissions to only trusted personnel and enable logging of all group membership changes. Within 7 days, conduct a full audit of existing administrative accounts and group memberships, and implement role-based access controls to enforce separation of duties. Within 30 days, if no vendor patch is available, consider deploying additional manual approval workflows for any group membership modifications, or isolate phpMyFAQ instances with higher security requirements.
If no vendor patch is available, restrict administrative access to only necessary personnel, enable detailed audit logging for group membership changes, and implement manual approval processes for any modifications to group assignments. Additionally, use network segmentation to limit exposure of the phpMyFAQ application and apply principle of least privilege to all administrator roles.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB