CVE-2026-66399

CVE-2026-66399 concerns phpMyFAQ prior to 4.1.6. A privilege-escalation flaw exists in GroupController::updateMembers(): administrators with only group-management rights can add themselves to privileged groups without verifying required rights, enabling immediate inheritance of those permissions ...

PT-2026-65000

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding...