Executive brief
phpMyFAQ is a self-hosted FAQ management system with delegated administrative controls. A delegated administrator holding only the GROUP_EDIT permission can exploit a missing authorization check to grant arbitrary permissions to user groups—including permissions they themselves do not hold—and then inherit those elevated rights by joining the group, resulting in escalation to full administrative control.
Technical details
The vulnerability is an authorization omission in the GroupController::updatePermissions endpoint (Controller/Administration/GroupController.php:309-349). The endpoint accepts attacker-controlled group_rights[] parameters and grants them to a target group without validating that the acting administrator holds each of those rights. The identical constraint was previously implemented in the sibling UserController::updateUserRights endpoint to prevent privilege escalation via user-rights assignment; the group-rights path was not updated. A non-SuperAdmin attacker with GROUP_EDIT permission calls POST /admin/group/update/permissions with a group_id they belong to (or can manage) and supplies high-value rights they do not possess. The endpoint grants every requested right via grantGroupRight() with no per-right authorization check, persisting the rights to the database. The attacker then inherits these elevated permissions by virtue of group membership, escalating to higher privileges up to SuperAdmin equivalent. Patch available in version 4.1.5.
Affected products
- thorsten phpMyFAQ <= 4.1.4
Timeline
- 2026-05-30: disclosed: Vulnerability discovered during audit of admin-API authorization hardening
- 2026-08-25: advisory: GitHub Security Advisory published
- 2026-06-14: patched: Fix released in version 4.1.5