Executive brief
phpMyFAQ, an open-source FAQ software, contains a security flaw that allows administrative users with limited permissions to grant themselves higher-level access. By exploiting this vulnerability, a low-level administrator can join privileged groups without authorization, gaining the ability to modify or delete other user accounts and sensitive data. This could lead to a complete takeover of the FAQ system's user management by an unauthorized staff member.
Technical details
A privilege escalation vulnerability exists in phpMyFAQ's GroupController::updateMembers() method due to missing authorization checks. While the endpoint is gated by the GROUP_EDIT permission, it fails to verify if the acting administrator possesses the specific rights held by the group they are modifying. An attacker with high-level (administrative) but restricted privileges can add themselves or others to a pre-existing privileged group (e.g., one with user-management rights). Because the application's permission engine treats group-inherited rights as equivalent to direct rights, the attacker immediately inherits all permissions of that group. This allows for unauthorized modification or deletion of user accounts. The issue is addressed in version 4.1.6.
Affected products
- thorsten phpMyFAQ < 4.1.6
Timeline
- 2026-07-13: advisory: Vendor advisory GHSA-28cc-v39j-vr95 published
- 2026-07-27: disclosed: CVE-2026-66399 published and added to NVD
- 2026-07-27: patched: Fix confirmed in version 4.1.6