phpMyFAQ versions 4.2.0-alpha through just before 4.2.0-beta contain a flaw in GroupController::saveCategoryRestrictions() that allows delegated administrators to assign categories outside their allowed scope. By sending POST requests to "/admin/api/group/category-restrictions" with category IDs that are out of scope or leaving the list empty, an affected administrator can grant groups unrestricted access to FAQ categories. This weakness violates the principle of least privilege, matching the Common Weakness enumeration CWE-269. The result is that a delegated admin can elevate their administrative rights without performing any additional privileged action.

The vulnerability affects the phpMyFAQ application developed by Thorsten, specifically all releases from the 4.2.0-alpha branch up through, but excluding, the 4.2.0-beta release. Users running any of these pre‑beta versions should verify their installation version and apply a newer release if available.

The CVSS base score of 8.5 indicates a high severity level. No EPSS data is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, which suggests no public exploit has been observed yet. The likely attack vector requires access to an account with delegated administrator privileges and the ability to perform HTTP POST requests to the protected API endpoint. Once acting as a delegated administrator, an attacker can exploit the flaw without requiring additional system access, making the exploit straightforward for insiders or compromised user accounts.