All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-57995
HIGHpublished 2026-06-30 23:17 UTC · 4 days ago · modified 2026-07-02 17:48 UTC
8.7
CVSS / 10
// description
phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full administrative control.
// weaknesses (CWE)
- CWE-269