CVE-2026-57995
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Jun 30, 2026
Vendor
unknown
Description
phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full administrative control.