phpMyFAQ 4.2.0-alpha.2 through the pre‑beta release contains a weakness in the updateUserRights API that removes per‑right language restrictions when rights are re‑granted. An administrator who holds the USER_EDIT role can submit language‑scoped rights for themselves or others, and by relaunching the update‑rights call the system drops the language filters. The result is that the attacker gains full ability to create, edit and publish FAQ entries across all languages, effectively bypassing the intended granular access control.

The affected vendor is thorsten’s phpMyFAQ application. All installations using phpMyFAQ version 4.2.0‑alpha.2 up to (but not including) version 4.2.0‑beta are impacted. No specific patch versions are listed in the advisory; upgrading to the beta release or later is recommended.

The CVSS score of 7 indicates a high impact vulnerability. EPSS data is not available, but the issue is not listed in CISA’s KEV catalog. Exploitation requires a user with USER_EDIT permissions who can perform API calls; the attack vector is a web‑based request to the updateUserRights endpoint. A compromised or malicious administrator can achieve full control of the FAQ content across all languages, representing a serious escalation from a limited editing role.