CyberRota Analysis
AI-GeneratedA privilege escalation vulnerability in phpMyFAQ prior to version 4.1.6 allows administrators with limited group-management permissions to join privileged groups without proper verification. This flaw enables attackers to gain user-management rights, potentially allowing them to modify or delete user accounts. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and account manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding user-management rights and immediately inherit those permissions to modify or delete user accounts.