{"id":"CVE-2026-56396","title":"phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()","summary":"phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-862"],"vendor":"phpMyFAQ","product":"phpMyFAQ","affected":["phpMyFAQ < 4.1.4"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-06-23T14:01:18.426641Z"},"exploitAvailable":true,"published":"2026-06-21","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:06:12.681Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-56396","references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-985r-q3qp-299h","label":"GitHub Security Advisory (GHSA-985r-q3qp-299h)"},{"url":"https://www.vulncheck.com/advisories/phpmyfaq-privilege-escalation-via-missing-authorization-in-edituser-and-updateuserrights","label":"VulnCheck Advisory: phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()"}],"tags":["cve.org","exploit-available"],"epss":0.00442,"epssPercentile":0.38686,"ingestedAt":"2026-11-08T14:51:22.347Z","slug":"CVE-2026-56396","body":"## Overview\n\nphpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or grant arbitrary rights to escalate to SuperAdmin access.\n\n## Affected\n\n- `phpMyFAQ < 4.1.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}