CVE-2026-57995: Phpmyfaq

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full administrative control.

Affected products

• Phpmyfaq Phpmyfaq: before 4.1.5 (fixed in 4.1.5)

Published 2026-06-30. Last modified 2026-07-02.