CVE-2026-111893 phpMyFAQ CVE debrief

Who should care

phpMyFAQ administrators, security teams, and developers who use or maintain phpMyFAQ installations should be aware of this vulnerability and take necessary actions to mitigate it. They should verify the presence of the vulnerability in their environments, assess the potential impact on their systems, and apply vendor patches or updates. Additionally, they should restrict access to the /admin/api/group/category-restrictions endpoint and monitor for

Why it matters

CVE-2026-111893 is a high-severity vulnerability in phpMyFAQ that allows delegated administrators to escalate their privileges by assigning categories outside their own scope. This can be done by sending a POST request to the /admin/api/group/category-restrictions endpoint with out-of-scope or empty categoryIds, effectively granting groups unrestricted category access. phpMyFAQ administrators and security teams should prioritize verifying the vulnerability's presence in their environments and assessing the potential impact on their systems.

• Delegated administrators may escalate their privileges and gain unrestricted category access.
• An attacker could exploit this vulnerability to gain elevated privileges and manipulate category restrictions.
• phpMyFAQ administrators and security teams must verify the presence of this vulnerability in their environments and assess the potential impact.
• Remediation priority is high due to the potential for privilege escalation and category manipulation.

Technical summary

The vulnerability is caused by a lack of proper validation in the GroupController::saveCategoryRestrictions() method, which allows delegated administrators to assign categories outside their own scope. This can be done by sending a POST request to the /admin/api/group/category-restrictions endpoint with out-of-scope or empty categoryIds. The vulnerability affects phpMyFAQ 4.2.0-alpha before 4.2.0-beta and has a CVSS score of 8.5. phpMyFAQ administrators and security teams should prioritize verifying the vulnerability's presence in their environments and assessing the potential impact on their systems.

Defensive priority

phpMyFAQ administrators and security teams should prioritize verifying the vulnerability's presence in their environments and assessing the potential impact on their systems.

Recommended defensive actions

• Verify the presence of the vulnerability in your phpMyFAQ environment
• Assess the potential impact on your system
• Restrict access to the /admin/api/group/category-restrictions endpoint
• Monitor for suspicious activity
• Apply vendor patches or updates
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is described in the CVE record and the NVD vulnerability detail page. The source references provide additional information about the vulnerability, including a detailed description of the issue and potential attack vectors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.