# CVE-2026-111890: phpMyFAQ updateUserRights privilege escalation

Source: https://junglewise.ai/threats/cve-2026-111890-phpmyfaq-from-4-2-0-alpha-2-before-4-2-0-beta-contains-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111890 · Severity: medium · CVSS 5.5 · Published 2026-10-17

phpMyFAQ is a frequently asked questions management system used to create and publish FAQ content across multiple languages with role-based access controls. An administrator with USER_EDIT permission can exploit a flaw in the rights-update API to drop language-scoped restrictions on their own account or other non-superadmin users, gaining unrestricted create, edit, and publish access to FAQ content in all languages. This bypasses the intended editorial trust boundary that limits admin privileges to specific languages.

Technologies: [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-111890 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111890 being exploited in the wild.

**How severe is CVE-2026-111890?** Medium severity, with a CVSS score of 5.5, published 17 October 2026.

**Which products and versions are affected?** Thorsten phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta.

**Is there a fix for CVE-2026-111890?** Yes: fixed in 4.2.0-beta. Until then: Restrict USER_EDIT permission to trusted administrators only and monitor the update-rights API endpoint for suspicious language-scope escalation attempts on user accounts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111890 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111890?** Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.2.0-beta

Restrict USER_EDIT permission to trusted administrators only and monitor the update-rights API endpoint for suspicious language-scope escalation attempts on user accounts.

## Technical details

The updateUserRights endpoint in UserController fails to preserve per-right language restrictions stored in faquser_right_language when re-granting rights. A non-superadmin admin holding USER_EDIT can pass a scope-blind permission check (hasPermission never reads faquser_right_language) and trigger refuseAllUserRights, which deletes all language restriction rows, followed by grantUserRight, which re-inserts rights without restriction rows. Missing restrictions are treated as global access, escalating a language-scoped right to all languages. The attack requires network access, authentication, CSRF token, and the attacker must already hold the target right in some scope.

## Affected products

- Thorsten phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta

## Timeline

- 2026-10-03: disclosed
- 2026-10-17: advisory

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h)
- [https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-privilege-escalation-via-updateuserrights](https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-privilege-escalation-via-updateuserrights)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)