phpMyFAQ Flaw Lets Admins Assign Categories Outside Scope Before Beta
A high-severity privilege escalation in phpMyFAQ allows delegated administrators to assign categories outside their scope, affecting versions prior to 4.2.0-beta.
Key points
- phpMyFAQ 4.2.0-alpha and earlier versions contain a privilege escalation vulnerability.
- The flaw allows delegated administrators to assign categories outside their defined scope.
- The issue is rated high severity with a CVSS score of 8.5 by the NVD.
Delegated administrators using phpMyFAQ versions prior to 4.2.0-beta face a confirmed privilege escalation risk that allows them to assign categories outside their own scope. The vulnerability exists in the GroupController::saveCategoryRestrictions() function and enables users to grant groups unrestricted access to categories via specific API requests.
How it unfolded
- The National Vulnerability Database recorded CVE-2026-111893 as a high-severity issue affecting phpMyFAQ.
- The flaw is located in the GroupController::saveCategoryRestrictions() method.
- The vulnerability allows POST requests to /admin/api/group/category-restrictions with empty or out-of-scope IDs.
Who is affected
The vulnerability affects phpMyFAQ 4.2.0-alpha and any version released before 4.2.0-beta. According to the NVD record, the issue is classified under CWE-269, indicating improper privilege management. It specifically impacts delegated administrators who are intended to have limited scope within the application’s category management system.
Our take on the response
The source material indicates that versions before 4.2.0-beta are affected. No confirmed patch or update has been released for the alpha version according to the provided records. Organizations should verify their version status against the 4.2.0-beta threshold to determine exposure.
Who needs to act first
Teams should prioritize systems where delegated administrators have access to sensitive category data. Check whether any administrative accounts have recently modified category restrictions unexpectedly. Roll out changes to a limited subset of servers first to ensure stability. Back up configuration files before making any adjustments to user permissions or application settings. Monitor logs for unusual POST requests to administrative endpoints.
What to do and how to stay safe: phpMyFAQ
- Verify the installed phpMyFAQ version and compare it against the 4.2.0-beta threshold.
- Review administrative logs for unauthorized modifications to category restrictions.
- Restrict network access to the administrative interface until a fix is confirmed.
- Prepare to update to 4.2.0-beta or later once the vendor confirms the patch.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111893?
The National Vulnerability Database rates the severity of CVE-2026-111893 as 8.5, which is classified as high.
Which phpMyFAQ versions are vulnerable to this privilege escalation?
phpMyFAQ 4.2.0-alpha and all versions released before 4.2.0-beta are affected by this vulnerability.
How can an attacker exploit this flaw?
Attackers can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant unrestricted access.
