CVE-2026-57996

phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint

Published Jul 15, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin accounts. A delegated administrator with USER_ADD/EDIT/DELETE permissions can call POST /admin/api/user/add with isSuperAdmin: true and attacker-chosen credentials to create a SuperAdmin account, then authenticate as that account to achieve full instance takeover.

Analysis

Technical impact

The vulnerability exists in the user/add API endpoint of phpMyFAQ, allowing an administrator who is not a SuperAdmin to create a SuperAdmin account by setting the isSuperAdmin flag to true during a POST request. This flaw, classified as CWE-269, lets the attacker obtain full control over the instance and all data.

Affected Systems

All phpMyFAQ builds prior to version 4.1.5 are affected. Administrators with USER_ADD, EDIT, or DELETE privileges can exploit the flaw; the product is distributed by the phpMyFAQ project.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, and the EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires authenticated API access; the attacker posts to /admin/api/user/add with isSuperAdmin set to true, then logs in as the newly created SuperAdmin to take over the system.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

phpMyFAQ

unaffected

Version	Status	Constraints
`0`	affected	< 4.1.5
`4.1.5`	unaffected	—

No data.

Vendor Product Versions

Phpmyfaq

Version	Status	Scheme	Platform
`[0,4.1.5)`	affected	generic	—
`4.1.5`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade phpMyFAQ to version 4.1.5 or later, which removes the missing access control.
Remove USER_ADD, EDIT, and DELETE permissions from all non‑SuperAdmin administrators to prevent account creation.
Restrict the user/add endpoint to SuperAdmin users only, either by disabling the endpoint for lower‑privilege accounts or by enforcing server‑side checks.

Generated by OpenCVE AI on July 31, 2026 at 04:00 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.442% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-r2f4-v277-hvw9
https://www.vulncheck.com/advisories/phpmyfaq-privilege-escalation-via-missing-superadmin-guard-in-user-add-endpoint

History

Jul 16, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 15, 2026 12:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin accounts. A delegated administrator with USER_ADD/EDIT/DELETE permissions can call POST /admin/api/user/add with isSuperAdmin: true and attacker-chosen credentials to create a SuperAdmin account, then authenticate as that account to achieve full instance takeover.
Title		phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint
First Time appeared		Phpmyfaq Phpmyfaq phpmyfaq
Weaknesses		CWE-269
CPEs		cpe:2.3:a:phpmyfaq:phpmyfaq::::::::
Vendors & Products		Phpmyfaq Phpmyfaq phpmyfaq
References		https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-r2f4-v277-hvw9 https://www.vulncheck.com/advisories/phpmyfaq-privilege-escalation-via-missing-superadmin-guard-in-user-add-endpoint
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`