CVE-2026-111890
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops p
CVSS
5.5
Medio
EPSS
0.2%
p13
KEV
—
Exploit Today
4
0-100
Publicado: 17 oct 2026 · Última mod.: 19 oct 2026 · CWE-269
0.2%EPSS · 30 días0.2%
2026-10-182026-10-19
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.
- github.comhttps://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h
- www.vulncheck.comhttps://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-privilege-escalation-via-updateuserrights
- github.comhttps://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1054538.4 ALT—
——0IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.12hCVE-2026-1100317.2 ALT16.3%
——5The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.16hCVE-2026-1119204.3 MED4.5%
——1Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write access on a parent project but read-only access to a child project can modify the child project's tasks and content.16hCVE-2026-1119098.1 ALT18.6%
——6phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.2dCVE-2026-1118936.5 MED19.8%
——6phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.2dCVE-2026-1118915.5 MED12.5%
——4phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.19h