CVE-2026-111890: phpMyFAQ updateUserRights privilege escalation

CVE-2026-111890 · Severity: medium · CVSS 5.5 · Published 2026-10-17

phpMyFAQ is a frequently asked questions management system used to create and publish FAQ content across multiple languages with role-based access controls. An administrator with USER_EDIT permission can exploit a flaw in the rights-update API to drop language-scoped restrictions on their own account or other non-superadmin users, gaining unrestricted create, edit, and publish access to FAQ content in all languages. This bypasses the intended editorial trust boundary that limits admin privileges to specific languages.

Technologies: Thorsten phpMyFAQ. Vendors: Thorsten.

Quick answers

Is CVE-2026-111890 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111890 being exploited in the wild.
How severe is CVE-2026-111890?
Medium severity, with a CVSS score of 5.5, published 17 October 2026.
Which products and versions are affected?
Thorsten phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta.
Is there a fix for CVE-2026-111890?
Yes: fixed in 4.2.0-beta. Until then: Restrict USER_EDIT permission to trusted administrators only and monitor the update-rights API endpoint for suspicious language-scope escalation attempts on user accounts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111890 attacked?
It is attacked over the network.
Am I affected by CVE-2026-111890?
Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 4.2.0-beta

Restrict USER_EDIT permission to trusted administrators only and monitor the update-rights API endpoint for suspicious language-scope escalation attempts on user accounts.

Technical details

The updateUserRights endpoint in UserController fails to preserve per-right language restrictions stored in faquser_right_language when re-granting rights. A non-superadmin admin holding USER_EDIT can pass a scope-blind permission check (hasPermission never reads faquser_right_language) and trigger refuseAllUserRights, which deletes all language restriction rows, followed by grantUserRight, which re-inserts rights without restriction rows. Missing restrictions are treated as global access, escalating a language-scoped right to all languages. The attack requires network access, authentication, CSRF token, and the attacker must already hold the target right in some scope.

Affected products

  • Thorsten phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta

Timeline

  • 2026-10-03: disclosed
  • 2026-10-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.