CVE-2026-111890: Improper Privilege Management in thorsten phpMyFAQ
Description
phpMyFAQ versions from 4.2.0-alpha.2 up to but not including 4.2.0-beta contain a privilege escalation vulnerability. The flaw exists in the UserController::updateUserRights function, which improperly manages language-scoped user rights. Administrators with USER_EDIT permission can exploit this to remove language restrictions on their rights, gaining unrestricted create, edit, and publish access across all FAQ languages.
CVSS v4.0
Score 7.0high
Affected software
thorsten
phpMyFAQ
pkg:github/thorsten/phpMyFAQRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in phpMyFAQ affects versions >=4.2.0-alpha.2 and <4.2.0-beta. It arises from improper privilege management in the UserController::updateUserRights method. When administrators with USER_EDIT rights re-grant language-scoped permissions, the system drops the language restrictions, effectively elevating their privileges to unrestricted FAQ management across all languages. This allows such administrators to bypass intended language-specific access controls and perform create, edit, and publish operations globally within the FAQ system.
Potential Impact
An attacker with administrative USER_EDIT rights can escalate their privileges by removing language restrictions on FAQ management rights. This leads to unauthorized full access to create, edit, and publish FAQ content across all languages, potentially compromising the integrity and confidentiality of multilingual FAQ data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict USER_EDIT permissions to trusted administrators only and monitor for unusual privilege changes related to language-scoped rights.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-17T12:16:44.849Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad3c6ce2cdf04f6565207f4
Added to database: 10/17/2026, 19:04:46 UTC
Last enriched: 10/17/2026, 19:33:24 UTC
Last updated: 10/17/2026, 22:21:05 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.