Beveiligingsadvies

CVE-2026-57995

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-06-30 22:08:42

Laatst bijgewerkt 2026-07-01 13:15:35

Toegewezen door VulnCheck

CVSS-score 8.8

Status PUBLISHED

Beschrijving

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full administrative control.

← Alle CVE's bekijken Bekijk op cve.org ↗