Executive brief
phpMyFAQ is an open-source knowledge base system. A security flaw allows lower-level administrators, who should only have limited user management rights, to create new accounts with full "SuperAdmin" privileges. An attacker with limited administrative access could use this to take complete control of the entire system, including all data, configurations, and backups.
Technical details
A privilege escalation vulnerability exists in the `user/add` API endpoint of phpMyFAQ due to an improper authorization check. While other user-management endpoints (like `editUser`) were previously hardened to ensure only SuperAdmins can grant SuperAdmin status, the `addUser` method in `UserController.php` lacks this guard. An attacker with delegated `USER_ADD/EDIT/DELETE` permissions can send a POST request to `/admin/api/user/add` with the `isSuperAdmin` parameter set to true. This allows the creation of a new account with full administrative privileges and attacker-controlled credentials, leading to a complete instance takeover. The issue is fixed in version 4.1.5.
Affected products
- phpMyFAQ phpMyFAQ < 4.1.5
Timeline
- 2026-06-14: advisory: Vendor advisory published on GitHub
- 2026-07-15: disclosed: NVD publication date