Executive brief
phpMyFAQ is an open-source FAQ software used to manage and publish knowledge bases. A security flaw allows delegated administrators with limited group-editing permissions to grant themselves or their groups any high-level administrative right. This could allow a restricted user to take full control of the FAQ system, potentially leading to the theft of sensitive data or complete service disruption.
Technical details
A privilege escalation vulnerability exists in phpMyFAQ's GroupController::updatePermissions due to an improper authorization check. While the system correctly restricts user-level permission assignments to only those rights held by the acting administrator, the group-level endpoint lacks this constraint. An attacker with the 'GROUP_EDIT' permission can send a crafted POST request to the /admin/group/update/permissions endpoint to assign high-privilege rights (such as SuperAdmin capabilities) to a group they belong to. Because the application fails to verify if the requester possesses the rights being assigned, the attacker inherits these new permissions through group membership. This allows for full administrative takeover. The issue is resolved in version 4.1.5.
Affected products
- phpMyFAQ phpMyFAQ < 4.1.5
Timeline
- 2026-06-14: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: NVD publication date