Executive brief
phpMyFAQ, an open-source FAQ software, contains a security flaw that allows staff members with limited administrative access to grant themselves full "SuperAdmin" control. By bypassing intended restrictions in the user management interface, a lower-level administrator can elevate their own permissions or modify other accounts. This could lead to a complete takeover of the FAQ system, allowing unauthorized users to access sensitive data, modify content, or disrupt services.
Technical details
A privilege escalation vulnerability exists in phpMyFAQ versions prior to 4.1.4 due to missing authorization checks in the UserController::editUser() and UserController::updateUserRights() API endpoints. While a previous patch (GHSA-xvp4-phqj-cjr3) secured password resets, these sibling endpoints remained unguarded, requiring only the basic 'edit_user' permission rather than 'SuperAdmin' status. An authenticated attacker with limited administrative rights can send crafted requests to these endpoints to set the 'is_superadmin' flag on their own account or grant themselves arbitrary system rights. This is a failure to enforce the invariant that non-SuperAdmins should not be able to modify SuperAdmin attributes or promote themselves. The issue is resolved in version 4.1.4.
Affected products
- phpMyFAQ phpMyFAQ < 4.1.4
Timeline
- 2026-05-25: advisory: GitHub Security Advisory GHSA-985r-q3qp-299h published
- 2026-06-21: disclosed: NVD publication and VulnCheck advisory release
- 2026-06-21: patched: Vulnerability addressed in version 4.1.4