Executive brief
phpMyFAQ, an open-source FAQ software, contains a flaw where the security fix for a previous vulnerability was incomplete. This allows a user with basic administrative permissions to bypass restrictions and grant themselves "SuperAdmin" status or modify other administrative accounts. An exploit could lead to a total takeover of the FAQ system, allowing unauthorized access to sensitive data and full control over the application's configuration.
Technical details
The vulnerability is a Missing Authorization (CWE-862) and IDOR in the UserController. While a previous fix (GHSA-xvp4-phqj-cjr3) added guards to the password reset function, it failed to secure sibling endpoints 'editUser()' and 'updateUserRights()'. An attacker with 'USER_EDIT' permissions (a standard administrative right) can send crafted API requests to 'admin/api/user/edit' to flip the 'is_superadmin' flag or 'admin/api/user/update-rights' to grant themselves any system privilege. The root cause is the lack of a check to ensure the actor is a SuperAdmin before modifying sensitive user attributes or permissions. A fix is available in version 4.1.4.
Affected products
- thorsten phpMyFAQ <= 4.1.3
Timeline
- 2026-05-25: disclosed: Initial discovery and report to vendor
- 2026-06-26: advisory: GitHub Advisory published
- 2026-06-26: patched: Version 4.1.4 released to address the incomplete fix