Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-111890— phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights

Quick assessment

Affected

thorsten phpMyFAQ

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

phpMyFAQ 从 4.2.0-alpha.2 版本起至 4.2.0-beta 版本之前，在方法中存在一个权限提升漏洞。当重新授予权限时，该漏洞会导致针对特定权限的语言限制被移除。持有权限的管理员可以通过更新权限 API 提交带有语言作用域的权限（包括针对自身），从而获得在所有语言中无限制地创建、编辑和发布常见问题解答（FAQ）的权限。

CVSS 5.5 · Medium EPSS 0.23% · P12 Updated Oct 18, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 2

Vendor	Product	Version Range	Status
thorsten	phpMyFAQ	`4.2.0-alpha.2< 4.2.0-beta`	affected
		`4.2.0-beta`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights

Source: CVE Program / CVE List V5

Vulnerability Description

phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

特权管理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
thorsten	phpMyFAQ	4.2.0-alpha.2 ~ 4.2.0-beta	-

II. Public POCs for CVE-2026-111890

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111890

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-111890 (2)

https://www.cve.org/CVERecord?id=CVE-2026-111890

Same Patch Batch · thorsten · 2026-10-17 · 28 CVEs total

CVE-2026-111911	9.8 CRITICAL	phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
CVE-2026-111908	8.3 HIGH	phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST
CVE-2026-111884	8.3 HIGH	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up o
CVE-2026-111882	8.1 HIGH	phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SS
CVE-2026-111909	8.1 HIGH	phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API
CVE-2026-111898	7.5 HIGH	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Link
CVE-2026-111901	7.5 HIGH	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
CVE-2026-111897	7.1 HIGH	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration E
CVE-2026-111907	7.1 HIGH	phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database
CVE-2026-111895	6.8 MEDIUM	phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID pref
CVE-2026-111893	6.5 MEDIUM	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restriction
CVE-2026-111910	6.5 MEDIUM	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachmen
CVE-2026-111886	6.5 MEDIUM	phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint
CVE-2026-111892	6.5 MEDIUM	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints
CVE-2026-111906	6.5 MEDIUM	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch A
CVE-2026-111905	6.0 MEDIUM	phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /
CVE-2026-111891	5.5 MEDIUM	phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions A
CVE-2026-111885	5.5 MEDIUM	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API
CVE-2026-111896	5.4 MEDIUM	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass
CVE-2026-111894	5.4 MEDIUM	phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data:

Showing top 20 of 28 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: phpMyFAQ

Same vendor: thorsten

Same weakness: CWE-269

V. Comments for CVE-2026-111890

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-111890— phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 2

I. Basic Information for CVE-2026-111890

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-111890

III. Intelligence Information for CVE-2026-111890

Vendor Advisories for CVE-2026-111890 (2)

Same Patch Batch · thorsten · 2026-10-17 · 28 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-111890

Leave a comment