CVE-2026-57995

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.5

Description An issue exists in the updatePermissions function within the GroupController that allows administrators with GROUP EDIT privileges to grant arbitrary rights to groups without verifying if they possess those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they are a member of, thereby inheriting those rights and escalating their privileges to full administrative control.

Recommendations Update to version 4.1.5 or later. As a temporary mitigation, restrict the use of the updatePermissions function in the GroupController for delegated administrators.