CVE-2026-57996

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.5

Description An issue exists that allows non-SuperAdmin administrators to escalate their privileges. A delegated administrator possessing USER ADD/EDIT/DELETE permissions can exploit the '/admin/api/user/add' endpoint by sending a POST request with the isSuperAdmin variable set to true and providing attacker-chosen credentials. This process enables the creation of a SuperAdmin account, allowing the attacker to authenticate as that user and achieve full instance takeover.

Recommendations Update to version 4.1.5 or later. Restrict access to the '/admin/api/user/add' endpoint for users without necessary administrative privileges.