phpMyFAQ before version 4.1.6 contains a privilege‑escalation flaw in the GroupController::updateMembers method. Administrators granted only group‑management rights can add themselves to any existing group. Because the code does not verify that the group has user‑management permissions, an attacker can join a privileged group and immediately receive the rights to create, modify or delete user accounts. The vulnerability therefore allows an attacker to gain the ability to create, modify or delete user accounts by joining a privileged group.

The flaw affects installations of Thorsten's phpMyFAQ earlier than version 4.1.6. Only administrators who possess group‑management permissions can exploit it by adding themselves to privileged groups without proper authorization checks.

The CVSS score of 8.5 marks the vulnerability as high severity. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation, and the issue is not listed in the CISA KEV catalog. The high CVSS suggests that the flaw could be exploited with reasonable effort by an authenticated attacker. The attack vector is administrative: an attacker with group‑management rights can add themselves to any group, bypassing the required authorization checks. Once in a privileged group, the attacker gains user‑management privileges, enabling the creation, alteration or deletion of user accounts. The ability to elevate to a higher privilege tier without additional verification poses a significant risk to the system's integrity.