CVE-2026-57995 phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions
Delegated administrators can escalate privileges to full admin by granting themselves arbitrary rights via a missing constraint in group permission updates.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57995?
CVE-2026-57995 is a high-severity vulnerability in phpMyFAQ, published on 30 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full administrative control.
Weakness: CWE-269
Which versions are affected by CVE-2026-57995?
4 open source packages ship an affected version, including phpmyfaq/phpmyfaq and thorsten/phpmyfaq.
| Package | Affected | Fixed in |
|---|---|---|
phpmyfaq/phpmyfaq Packagist | All versions | 4.1.5 |
phpmyfaq/phpmyfaq Packagist | All versions | 4.1.5 |
thorsten/phpmyfaq Packagist | All versions | 4.1.5 |
thorsten/phpmyfaq Packagist | All versions | 4.1.5 |
How do I fix CVE-2026-57995?
Upgrade phpmyfaq/phpmyfaq to 4.1.5 or later.
Is CVE-2026-57995 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57995 exists.
Sources
Also known as GHSA-996g-x95h-p2f5, GHSA-pg62-f8g4-4wqh.