phpMyFAQ: Privilege escalation via group category restrictions API
Summary
phpMyFAQ 4.2.0-alpha up to 4.2.0-alpha.2 lets a category-restricted delegated administrator assign group category restrictions for categories outside their own scope. Sending an empty categoryIds list makes the group right apply to all categories. An attacker needs a valid delegated admin account with group-management rights, so the flaw is a risk mainly after account compromise or insider misuse.
Affected
- phpMyFAQ 4.2.0-alpha to before 4.2.0-beta (vendor advisory: <= 4.2.0-alpha.2)
- Affected endpoint: POST /admin/api/group/category-restrictions
Fixed in
- Upgrade to phpMyFAQ 4.2.0-beta or later
Workaround
- Unknown. No vendor workaround is documented; the CNA advice is to upgrade.
- Until the upgrade: limit who holds admin and group-management rights, review existing group category restrictions for unexpected unrestricted access, restrict admin panel access to VPN or known IP ranges, and review the admin activity log for changes to group rights.
Exploitation
- VulDB: no public exploit available. CISA SSVC: exploitation status PoC, automatable: no.
- No evidence of in-the-wild exploitation found. KEV status not verified.
Our recommendation
- Upgrade phpMyFAQ to 4.2.0-beta or later, or the current release line.
- Until then, restrict admin and group-management rights to trusted staff and enforce strong authentication for admin accounts.
- Review group category restrictions for groups with unrestricted access that should be limited.
- Restrict admin panel access to VPN or known IP ranges and monitor admin activity logs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-gv7w-78f6-mcmh github.com
- VulnCheck advisory www.vulncheck.com
- VulDB CVE-2026-111893 vuldb.com
- VulDB vulnerability 421601 vuldb.com
- Vulners CVE-2026-111893 vulners.com
- phpMyFAQ project website www.phpmyfaq.de
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:27.
Original description (NVD)
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.