https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T06:49:11.985769+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-56396 CVE-2026-56396 — phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights() 2026-09-29T06:49:11.996474+00:00

Affected: phpMyFAQ

phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or grant arbitrary rights to escalate to SuperAdmin access.