CVE-2026-56396: phpMyFAQ privilege escalation in editUser and updateUserRights

CVE-2026-56396 · Severity: high · CVSS 8.8 · Published 2026-06-21

phpMyFAQ, an open-source FAQ software, contains a security flaw that allows staff members with limited administrative access to grant themselves full "SuperAdmin" control. By bypassing intended restrictions in the user management interface, a lower-level administrator can elevate their own permissions or modify other accounts. This could lead to a complete takeover of the FAQ system, allowing unauthorized users to access sensitive data, modify content, or disrupt services.

Technologies: phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-56396 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56396 being exploited in the wild.
How severe is CVE-2026-56396?
High severity, with a CVSS score of 8.8, published 21 June 2026.
Which products and versions are affected?
phpmyfaq/phpmyfaq (Packagist) ECOSYSTEM:introduced=0,fixed=4.1.4; thorsten/phpmyfaq (Packagist) ECOSYSTEM:introduced=0,fixed=4.1.4.
Is there a fix for CVE-2026-56396?
Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.4 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56396 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-56396?
Check whether you run phpmyfaq/phpmyfaq (Packagist) or thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.4 or later
    composer require phpmyfaq/phpmyfaq:^4.1.4
  • thorsten/phpmyfaq (Packagist): upgrade to 4.1.4 or later
    composer require thorsten/phpmyfaq:^4.1.4

Technical details

A privilege escalation vulnerability exists in phpMyFAQ versions prior to 4.1.4 due to missing authorization checks in the UserController::editUser() and UserController::updateUserRights() API endpoints. While a previous patch (GHSA-xvp4-phqj-cjr3) secured password resets, these sibling endpoints remained unguarded, requiring only the basic 'edit_user' permission rather than 'SuperAdmin' status. An authenticated attacker with limited administrative rights can send crafted requests to these endpoints to set the 'is_superadmin' flag on their own account or grant themselves arbitrary system rights. This is a failure to enforce the invariant that non-SuperAdmins should not be able to modify SuperAdmin attributes or promote themselves. The issue is resolved in version 4.1.4.

Affected products

  • phpMyFAQ phpMyFAQ < 4.1.4

Identifiers

  • CVE-2026-56396
  • GHSA-985r-q3qp-299h

Timeline

  • 2026-05-25: advisory: GitHub Security Advisory GHSA-985r-q3qp-299h published
  • 2026-06-21: disclosed: NVD publication and VulnCheck advisory release
  • 2026-06-21: patched: Vulnerability addressed in version 4.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.