CVE-2026-57995highCWE-269

CVE-2026-57995: falha de alta gravidade em phpMyFAQ

phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar phpMyFAQ+ Monitorar thorsten/phpmyfaq

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.4%
phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full administrative control.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
phpMyFAQ · phpMyFAQ
CVEs relacionadas — phpMyFAQ

No mesmo produto, das mais perigosas para as menos.

CVE-2026-57996HIGHphpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add EndpointEPSS 0.4%CVE-2026-56396HIGHphpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()EPSS 0.4%CVE-2026-57961MEDIUMphpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths FunctionEPSS 0.4%CVE-2026-57994MEDIUMphpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API EndpointsEPSS 0.4%