Is CVE-2026-111891 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111891 being exploited in the wild.

How severe is CVE-2026-111891?

Medium severity, with a CVSS score of 5.5, published 17 October 2026.

Which products and versions are affected?

Thorsten phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta.

Is there a fix for CVE-2026-111891?

Yes: fixed in 4.2.0-beta. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111891 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111891?

Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111891: phpMyFAQ group permission API privilege escalation

CVE-2026-111891 · Severity: medium · CVSS 5.5 · Published 2026-10-17

phpMyFAQ is a knowledge base and FAQ management system that uses role-based permissions to control administrator access. A privilege escalation vulnerability allows non-superadmin administrators with group management rights to escalate their permissions from a narrow scope (specific languages or categories) to unrestricted access across the entire FAQ database. This allows them to create, edit, and publish content globally, bypassing intended administrative delegation controls.

Technologies: Thorsten phpMyFAQ. Vendors: Thorsten.

Quick answers

Is CVE-2026-111891 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111891 being exploited in the wild.
How severe is CVE-2026-111891?: Medium severity, with a CVSS score of 5.5, published 17 October 2026.
Which products and versions are affected?: Thorsten phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta.
Is there a fix for CVE-2026-111891?: Yes: fixed in 4.2.0-beta. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111891 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111891?: Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.2.0-beta

Technical details

The vulnerability exists in the GroupController::updatePermissions and GroupController::updateMembers API endpoints, which use a scope-blind permission check (MediumPermission::hasPermission) that only verifies whether a user holds a right somewhere, without validating the language or category scope restrictions. An attacker can grant a group a right they hold in restricted scope, then join the group themselves, gaining that right unrestricted. The grantGroupRight function writes group grants without corresponding restriction table entries, causing missing restrictions to be treated as global access.

Affected products

Thorsten phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta

Timeline

2026-10-03: disclosed
2026-10-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.