CVE-2026-111890 Details
Description
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.
A privilege escalation vulnerability has been identified in phpMyFAQ versions 4.2.0-alpha.2 prior to 4.2.0-beta. The issue resides in the UserController's updateUserRights function, where per-right language restrictions are dropped when rights are re-granted. This flaw allows non-superadmin administrators with the USER_EDIT right to escalate language-scoped content rights, gaining unrestricted access to create, edit, and publish FAQ content across all languages.
The vulnerability can be addressed by enforcing language scope checks during the rights update process, ensuring that non-superadmin administrators cannot widen the scope of rights or drop language restrictions. This can be achieved by applying the same language assignment checks used in other administrative functions before updating rights, and by adding a guard to prevent self-targeting.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-privilege-escalation-via-updateuserrights | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | >= 4.2.0-alpha.2, < 4.2.0-beta (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |