CVE-2026-111890Medium· 5.5▾ SunlitphpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.
phpMyFAQ >= 4.2.0-alpha.2 < 4.2.0-betaRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111891Medium· 5.5phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API
CVE-2026-111893Medium· 6.5phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API
CVE-2026-111909High· 8.1phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API
CVE-2026-111888Low· 2.7phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API
CVE-2026-111887Medium· 5.3phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint
CVE-2026-111885Medium· 5.5phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API