Executive brief
phpMyFAQ, an open-source FAQ software, contains a security flaw in its administrative interface. An attacker with low-level administrative access can change the password of any other user, including the system's SuperAdmin. This allows a minor administrative user to take full control of the entire application and its data.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the `overwritePassword()` method within `src/phpMyFAQ/Controller/Administration/Api/UserController.php`. The application fails to verify if the requesting administrator has the authority to modify the specific `userId` provided in the PUT request to `/admin/api/user/overwrite-password`. While the endpoint checks for general `USER_EDIT` permissions, it does not validate that the target user has a lower or equal privilege level. Consequently, a low-privileged administrator can escalate their privileges to SuperAdmin by targeting `userId=1`. This issue is resolved in version 4.1.3.
Affected products
- thorsten phpMyFAQ < 4.1.3
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-05-28: disclosed: CVE published to NVD