CVE-2026-111893 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API
Delegated administrators can escalate privileges by assigning unrestricted category access to groups via the API.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111893?
CVE-2026-111893 is a high-severity vulnerability in thorsten phpMyFAQ, published on 17 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.
Weakness: CWE-269
Which versions are affected by CVE-2026-111893?
How do I fix CVE-2026-111893?
No fix has been published for CVE-2026-111893 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111893 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111893 exists.
Sources
Also known as GHSA-gv7w-78f6-mcmh, GHSA-xr8j-x8f4-2j2f.