CVE-2026-56396: phpMyFAQ Privilege Escalation Flaw

CVE-2026-56396 Overview

CVE-2026-56396 affects phpMyFAQ versions before 4.1.4. The vulnerability stems from missing authorization checks [CWE-862] in the editUser() and updateUserRights() endpoints. Authenticated administrators who hold the edit_user permission but lack SuperAdmin status can escalate their privileges. Attackers exploit the flaw by setting the is_superadmin flag or granting arbitrary rights to their own account through the affected endpoints. Successful exploitation grants full SuperAdmin access to the phpMyFAQ instance, compromising confidentiality, integrity, and availability of stored content and user data.

Critical Impact
A non-SuperAdmin user with edit_user permission can elevate to SuperAdmin and gain full administrative control of the phpMyFAQ application.

Affected Products

phpMyFAQ versions prior to 4.1.4
phpMyFAQ editUser() endpoint
phpMyFAQ updateUserRights() endpoint

Discovery Timeline

2026-06-21 - CVE-2026-56396 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56396

Vulnerability Analysis

phpMyFAQ is an open source frequently asked questions (FAQ) management application written in PHP. The application implements role-based access control, distinguishing between SuperAdmin users and regular administrators with granular permissions. The flaw resides in two API endpoints responsible for user management: editUser() and updateUserRights().

Both endpoints validate that the calling user is authenticated and holds the edit_user permission. However, neither endpoint enforces that the caller possesses SuperAdmin status before allowing modifications to privileged attributes. As a result, an administrator without SuperAdmin status can submit requests that promote themselves or other users to SuperAdmin or assign arbitrary permission grants.

The vulnerability is categorized under CWE-862: Missing Authorization. Exploitation requires network access and low-privileged authentication, but no user interaction.

Root Cause

The root cause is missing authorization logic between authentication and the privileged write operations. The endpoints check whether the caller can edit users but do not check whether the caller has the authority to assign SuperAdmin or elevated rights. The is_superadmin flag and user rights array are treated as ordinary editable fields rather than protected attributes restricted to SuperAdmin operators.

Attack Vector

An attacker first obtains valid credentials for an administrator account that carries the edit_user permission. The attacker then issues an authenticated HTTP request to the editUser() endpoint and sets is_superadmin=true on their own account, or invokes updateUserRights() to assign rights that exceed their current scope. After re-authentication or session refresh, the attacker operates with full SuperAdmin privileges across the phpMyFAQ instance.

No verified public exploit code is available at the time of writing. See the GitHub Security Advisory and the VulnCheck Advisory on phpMyFAQ for technical detail.

Detection Methods for CVE-2026-56396

Indicators of Compromise

HTTP POST or PUT requests to phpMyFAQ user management endpoints that include is_superadmin=1 or is_superadmin=true in the request body.
Unexpected promotion events in the phpMyFAQ user audit log where a non-SuperAdmin account modifies the SuperAdmin flag.
New or modified user records where the is_superadmin column changed without a corresponding SuperAdmin actor in the application log.
Bulk calls to updateUserRights() granting elevated rights shortly after an administrator login.

Detection Strategies

Inspect web server access logs for requests to admin endpoints handling editUser and updateUserRights actions and correlate the caller's role with the modified target.
Enable phpMyFAQ database audit logging and alert on row-level changes to the is_superadmin field in the user table.
Compare current SuperAdmin membership against a known baseline and flag any new SuperAdmin accounts.

Monitoring Recommendations

Forward phpMyFAQ application and web server logs to a centralized SIEM for correlation across authentication and admin actions.
Monitor for repeated administrative API calls originating from a single low-privilege session.
Alert on creation of admin sessions immediately following a permission change on the calling account.

How to Mitigate CVE-2026-56396

Immediate Actions Required

Upgrade all phpMyFAQ deployments to version 4.1.4 or later.
Audit existing administrator accounts and remove any unexpected SuperAdmin assignments.
Rotate credentials for accounts holding the edit_user permission and review their assigned rights.
Review web server and application logs for prior exploitation indicators across the full retention window.

Patch Information

The maintainers addressed the vulnerability in phpMyFAQ 4.1.4. The fix adds SuperAdmin authorization checks to the editUser() and updateUserRights() endpoints so non-SuperAdmin callers cannot modify the is_superadmin flag or grant rights they do not themselves hold. Refer to the GitHub Security Advisory GHSA-985r-q3qp-299h for fix commit references.

Workarounds

Restrict the edit_user permission to trusted SuperAdmin accounts only until upgrading.
Place the phpMyFAQ admin interface behind network access controls such as VPN or IP allowlists.
Enforce strong authentication and session policies on all administrator accounts to reduce the chance of credential compromise.

bash

# Configuration example: verify installed phpMyFAQ version and upgrade
grep -R "PMF_VERSION" /var/www/phpmyfaq/ | head -n 1
# If version < 4.1.4, upgrade:
cd /var/www/phpmyfaq
git fetch --tags && git checkout 4.1.4
# or download the 4.1.4 release archive from the official phpMyFAQ release page