Authorization Omission in phpMyFAQ Group Permissions

phpMyFAQ contains an authorization omission vulnerability in the GroupController::updatePermissions endpoint (accessible via POST /admin/group/update/permissions). While the application previously hardened UserController::updateUserRights to prevent delegated administrators from assigning permissions they do not personally hold, this constraint was not applied to the equivalent group-rights endpoint. An attacker with the delegated GROUP_EDIT permission can modify the permissions of any group they control. By assigning high-privilege rights to a group of which they are a member, the attacker inherits those rights, enabling privilege escalation to full administrative access. This flaw affects phpMyFAQ versions up to and including 4.1.4.

Attack Chain

1. Attacker gains access to a low-privilege administrative account granted the GROUP_EDIT permission.
2. Attacker logs into the phpMyFAQ administration interface.
3. Attacker identifies or gains membership in a group (G) they manage through their GROUP_EDIT authority.
4. Attacker constructs a POST request to /admin/group/update/permissions targeting group ID G.
5. Attacker includes group_rights[] parameters containing one or more high-privilege right IDs (e.g., user administration) that the attacker's account does not possess.
6. The updatePermissions controller verifies the attacker holds GROUP_EDIT but fails to validate that the attacker possesses the specific rights being granted.
7. The application updates the group's permission set in the faqgroup_right database table.
8. The attacker inherits the newly granted administrative rights through their membership in group G, resulting in full application-level compromise.

Impact

Successful exploitation allows a delegated administrator (who is not a SuperAdmin) to escalate their privileges to any right within the application, including full administrative read/write/availability control. This bypasses the intended compartmentalization of administrative duties. The impact is critical to the integrity and confidentiality of the knowledge base managed by phpMyFAQ.

Recommendation

Prioritize applying vendor-supplied patches for phpMyFAQ version 4.1.4 or newer. Until patching is possible, audit all accounts currently holding the GROUP_EDIT permission and restrict group membership for these accounts. Use the following webserver log monitoring to identify potential exploitation attempts.