CVE-2026-56396 AKAOMA CVE VULNERABILITIES / 7h phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or grant arbitrary rights to escalate to SuperAdmin access.

Back cve.akaoma.com

CVE-2026-56396 AKAOMA CVE VULNERABILITIES / 7h phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or grant arbitrary rights to escalate to SuperAdmin access.

cve.akaoma.com • June 21, 2026

Share: View original

8.8 /10 Severe Risk Cybersecurity professionals consider CVE-2026-56396 an immediate threat requiring urgent mitigation.

Cybersecurity professionals consider CVE-2026-56396 an immediate threat requiring urgent mitigation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in phpMyFAQ Allows Privilege Escalation A critical vulnerability, CVE-2026-56396, has been identified in phpMyFAQ versions prior to 4.1.4. This vulnerability allows authenticated non-SuperAdmin users with edit_user permissions to escalate their privileges to SuperAdmin by modifying the is_superadmin flag through the editUser() and updateUserRights() endpoints. The CVSS base score assigned to this vulnerability is 8.8, indicating a high severity level. Currently, there is no evidence of public proof-of-concept or active exploitation. A patch has been released in phpMyFAQ version 4.1.4, and users are urged to upgrade immediately. Organizations should review access controls and audit user accounts with edit_user permissions to prevent unauthorized privilege escalations. Security professionals consider this vulnerability an immediate threat requiring urgent mitigation. 3 sources 74

Extracted Entities

Attack Types (1)

Privilege Escalation

CVEs (1)

CWE Weaknesses (1)

CWE-862 - Missing Authorization

MITRE ATT&CK (1)

T1068 - Exploitation for Privilege Escalation

Platforms (1)