https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 20:53:28 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66399 <p><strong>Affected:</strong> thorsten phpMyFAQ</p> <p>phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding user-management rights and immediately inherit those permissions to modify or delete user accounts.</p> <p><strong>Affected:</strong> thorsten phpMyFAQ</p> <p>phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding user-management rights and immediately inherit those permissions to modify or delete user accounts.</p> https://vulnerability.circl.lu/vuln/cve-2026-66399