PT-2026-51237

CVE-2026-56396

Published

2026-05-25

Updated

2026-06-26

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.4

Description Missing authorization flaws in the editUser() and updateUserRights() endpoints allow authenticated administrators to escalate privileges. An authenticated non-SuperAdmin user possessing the edit user permission can modify the is superadmin flag or grant arbitrary rights to an account, enabling them to gain full SuperAdmin access and complete control over the knowledge base.

Recommendations Upgrade to version 4.1.4.

Exploitability

Exploit

Fix

Impacts

Researchers

0Xshemesh

Snailsploit

Vendors

Affected products

Weakness enumeration

CWE-832: Unlock of a Resource that is not Locked