The vulnerability exists in the user/add API endpoint of phpMyFAQ, allowing an administrator who is not a SuperAdmin to create a SuperAdmin account by setting the isSuperAdmin flag to true during a POST request. This flaw, classified as CWE-269, lets the attacker obtain full control over the instance and all data.

All phpMyFAQ builds prior to version 4.1.5 are affected. Administrators with USER_ADD, EDIT, or DELETE privileges can exploit the flaw; the product is distributed by the phpMyFAQ project.

The CVSS score of 8.7 indicates high severity, and the EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires authenticated API access; the attacker posts to /admin/api/user/add with isSuperAdmin set to true, then logs in as the newly created SuperAdmin to take over the system.