Privilege Escalation in phpMyFAQ by Thorsten
CVE-2026-111893

8.5HIGH

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111893?

A vulnerability in phpMyFAQ allows delegated administrators to bypass category restrictions through the GroupController::saveCategoryRestrictions() function. Unsuspecting category-restricted administrators can exploit this flaw by submitting POST requests to /admin/api/group/category-restrictions with unauthorized category IDs. This oversight enables them to grant groups unrestricted access to categories outside their designated scope, potentially leading to unauthorized data exposure.

Affected Version(s)

phpMyFAQ 4.2.0-alpha < 4.2.0-beta

phpMyFAQ 4.2.0-beta

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nirtem
.