CVE-2026-66399

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6

Description A privilege escalation issue exists in the updateMembers() function within the GroupController. This flaw allows administrators who possess only group-management permissions to join privileged groups because the system fails to verify the required rights. By adding themselves to groups that hold user-management rights, attackers can inherit those permissions to modify or delete user accounts.

Recommendations Update to version 4.1.6 or later. As a temporary mitigation, restrict access to the updateMembers() function for users with only group-management permissions.