Security Advisory

CVE-2026-56396

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-21 13:27:03

Last updated 2026-06-23 14:19:37

Assigner VulnCheck

CVSS score 8.7

State PUBLISHED

Description

phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or grant arbitrary rights to escalate to SuperAdmin access.

← Browse all CVEs View on cve.org ↗