The bug lies in the group permission API used by phpMyFAQ. The updatePermissions and updateMembers endpoints do not enforce language or category scope when granting rights, allowing an attacker who holds the GROUP_EDIT permission to give a group a right they already hold, but only within a narrow scope. By self‑joining that group through updateMembers, the attacker can obtain unrestricted access to create, edit, and publish any FAQ entry across all languages and categories, effectively elevating their privileges within the application.

phpMyFAQ versions 4.2.0‑alpha.2 through the release that precedes 4.2.0‑beta are affected. Administrators who are not superadmins but have the GROUP_EDIT permission can exploit this flaw.

The CVSS score of 7 indicates a high severity. While EPSS is not available, the flaw is exploitable by any authenticated user with GROUP_EDIT rights, and the application is likely web‑exposed, making the attack vector relatively straightforward. The vulnerability is not listed in the CISA KEV catalog, but its potential to grant full editorial control makes it a serious internal threat.