CVE-2026-111893: Improper Privilege Management in thorsten phpMyFAQ

CVE-2026-111893 is a privilege escalation vulnerability in phpMyFAQ affecting versions >=4.2.0-alpha and <4.2.0-beta. The flaw exists in the GroupController::saveCategoryRestrictions() method, which improperly manages privilege boundaries for delegated administrators. By exploiting this, category-restricted administrators can POST to the API endpoint /admin/api/group/category-restrictions with categoryIds that are either outside their permitted scope or empty, thereby granting groups unrestricted access to categories they should not control.

This vulnerability allows delegated administrators, who should have limited category access, to escalate their privileges and assign unrestricted category access to groups. This could lead to unauthorized access or modification of content across all categories, violating access control policies and potentially exposing sensitive information or administrative functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict delegated administrator privileges carefully and monitor API usage for suspicious category restriction changes.