CVE-2026-111890
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.
Risk Assessment
An administrator with USER_EDIT can escalate privileges to full control over FAQ content across all languages, bypassing language scope restrictions.
Recommendation
Upgrade phpMyFAQ to 4.2.0-beta or later and verify that no user rights were granted without language restrictions.
Other vulnerabilities in phpMyFAQ
See all- CVE-2026-56736High
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft.
- CVE-2026-57994Medium
A vulnerability in phpMyFAQ before version 4.1.5 allows unauthenticated attackers to retrieve inactive (draft or review-only) FAQ content due to inconsistent filtering in public API endpoints.
- CVE-2026-57961Low
phpMyFAQ before version 4.1.5 contains a path traversal vulnerability in the concatenatePaths() function in Wrapper.php. An authenticated user with FAQ editing privileges can store crafted HTML with image paths that are processed during PDF generation. Lack of path canonicalization and root-directory containment validation may allow reading files outside the intended content directory.
- CVE-2017-15808High
In phpMyFaq before version 2.9.9, there is a CSRF vulnerability in admin/ajax.config.php.
- CVE-2017-15735High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability that allows modification of a glossary.
- CVE-2017-15734High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/stat.main.php.
- CVE-2017-15733High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/ajax.attachment.php and admin/att.main.php.
- CVE-2017-15732High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/news.php.
- CVE-2017-15731High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/stat.adminlog.php.
- CVE-2017-15730High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/stat.ratings.php.
Original NVD description (English source)
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS