CVE-2026-57996: phpMyFAQ Privilege Escalation Vulnerability

CVE-2026-57996 Overview

CVE-2026-57996 is a privilege escalation vulnerability in phpMyFAQ versions before 4.1.5. The flaw resides in the user/add API endpoint, which fails to enforce a SuperAdmin authorization guard. A delegated administrator holding only USER_ADD, USER_EDIT, or USER_DELETE permissions can create a SuperAdmin account by submitting isSuperAdmin: true in the request body. After creating the account with attacker-chosen credentials, the actor authenticates and takes full control of the phpMyFAQ instance. The weakness is classified under [CWE-269: Improper Privilege Management].

Critical Impact
A low-privileged administrator can escalate to SuperAdmin and achieve full instance takeover through a single authenticated API call.

Affected Products

phpMyFAQ versions prior to 4.1.5
Deployments exposing the /admin/api/user/add endpoint
Instances with delegated administrator accounts holding user management permissions

Discovery Timeline

2026-07-15 - CVE-2026-57996 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-57996

Vulnerability Analysis

phpMyFAQ implements role-based administrator permissions that separate user management from SuperAdmin privileges. The POST /admin/api/user/add endpoint validates that the caller holds USER_ADD permission but does not verify that the caller is a SuperAdmin before accepting a isSuperAdmin: true attribute in the request payload. This authorization gap violates the principle of least privilege and enables vertical privilege escalation from a delegated administrator role to full instance control.

Once the SuperAdmin account is created, the attacker authenticates through the standard login flow. SuperAdmin capabilities in phpMyFAQ include managing all users, modifying configuration, uploading attachments, and executing administrative operations that can lead to arbitrary content control and downstream compromise of hosted data.

Root Cause

The root cause is a missing authorization check in the user creation handler. The endpoint trusts the client-supplied isSuperAdmin field without validating whether the authenticated caller possesses SuperAdmin rights. This is a classic broken access control pattern where object-level permissions are checked but attribute-level permissions are not.

Attack Vector

The attacker must first hold a valid delegated administrator session with USER_ADD permission. The attacker sends an authenticated POST request to /admin/api/user/add with a JSON body containing chosen login, password, email, and isSuperAdmin: true. The server persists the new account with SuperAdmin flag enabled. The attacker then authenticates as the newly created SuperAdmin. Details are documented in the GitHub Security Advisory GHSA-r2f4-v277-hvw9 and the VulnCheck Privilege Escalation Advisory.

Detection Methods for CVE-2026-57996

Indicators of Compromise

Unexpected SuperAdmin accounts appearing in the phpMyFAQ user table
HTTP POST requests to /admin/api/user/add containing isSuperAdmin set to true originating from non-SuperAdmin sessions
Successful login events for newly created administrator accounts followed by configuration or user management changes
Audit log entries showing account creation without corresponding SuperAdmin-initiated activity

Detection Strategies

Parse web server access logs for POST requests to /admin/api/user/add and correlate the requesting session against the account's actual role level
Query the phpMyFAQ user database for accounts with the SuperAdmin flag and validate each against a known-good baseline
Enable and review phpMyFAQ administrative audit logs for user creation events performed by delegated administrators

Monitoring Recommendations

Alert on any creation of SuperAdmin accounts outside of change-controlled provisioning windows
Monitor authentication events for first-time logins by newly created administrator accounts
Track unusual API call patterns against /admin/api/user/* endpoints, particularly from accounts that rarely perform user management

How to Mitigate CVE-2026-57996

Immediate Actions Required

Upgrade phpMyFAQ to version 4.1.5 or later without delay
Audit all existing SuperAdmin accounts and remove any that were not explicitly provisioned
Rotate credentials for all administrator accounts and force re-authentication
Restrict network exposure of the /admin/ interface to trusted management networks where possible

Patch Information

The fix is available in phpMyFAQ 4.1.5. The patched release adds a SuperAdmin authorization guard on the user/add endpoint that rejects requests attempting to set isSuperAdmin: true unless the caller is already a SuperAdmin. Refer to the GitHub Security Advisory GHSA-r2f4-v277-hvw9 for release details.

Workarounds

Revoke USER_ADD, USER_EDIT, and USER_DELETE permissions from all non-SuperAdmin administrator accounts until patching is complete
Place the /admin/ path behind an authenticating reverse proxy or IP allowlist to limit which principals can reach the vulnerable endpoint
Enable enhanced logging on the administrative API to detect exploitation attempts during the remediation window

bash

# Configuration example: restrict /admin/ to a management CIDR in nginx
location /admin/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://phpmyfaq_backend;
}