CVE-2026-66399 — Vulnerability intelligence

—

Published: 2026-07-27T16:18:12.633

CVSS

8.5

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding user-management rights and immediately inherit those permissions to modify or delete user accounts.

Sources

• CVE-2026-66399
• Original advisory
• Original advisory