CVE-2026-111891: Improper Privilege Management in thorsten phpMyFAQ

The vulnerability in phpMyFAQ affects versions >=4.2.0-alpha.2 and <4.2.0-beta. It involves improper privilege management in the group permission API, specifically in the updatePermissions and updateMembers endpoints. These endpoints fail to consider language or category scope when verifying held rights, enabling non-superadmin administrators with GROUP_EDIT permission to grant a group rights they hold only in a limited scope and then self-join that group. This results in unauthorized, unrestricted access to create, edit, and publish FAQs across all languages and categories, effectively escalating their privileges beyond intended limits.

An attacker with non-superadmin administrator privileges and GROUP_EDIT rights can escalate their permissions to gain unrestricted access to FAQ creation, editing, and publishing across all languages and categories. This undermines the intended permission scoping and can lead to unauthorized content modification and potential information integrity issues within phpMyFAQ.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict GROUP_EDIT permissions to trusted administrators only and monitor for unusual permission changes or group membership modifications.