CVE-2026-57995
Fixed upstream EPSS <1%CVSS 8.8
phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full administrative control.
Products: phpmyfaq
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | phpmyfaq/phpmyfaq | 4.1.5 |
| Packagist | thorsten/phpmyfaq | 4.1.5 |