{"action":"Upgrade phpmyfaq/phpmyfaq to 4.1.5 or later.","affected":[{"fixed":"4.1.5","introduced":"0"}],"component":"phpmyfaq/phpmyfaq","cve_ids":["CVE-2026-57995"],"ecosystem":"Packagist","epss":0.00442,"exploited":false,"fixed_versions":["4.1.5"],"ghsa_id":"GHSA-pg62-f8g4-4wqh","id":"tcs_01M5KF6B4EYSDBJKESZ7NBEXB8","modified_at":"2026-08-26T01:21:15.921852722Z","published_at":"2026-08-25T17:32:07Z","references":["https://osv.dev/vulnerability/GHSA-pg62-f8g4-4wqh","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pg62-f8g4-4wqh","https://github.com/thorsten/phpMyFAQ/commit/de5016607dd606ef161cccd10fa5deec303c834e","https://github.com/thorsten/phpMyFAQ"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-pg62-f8g4-4wqh","url":"https://osv.dev/vulnerability/GHSA-pg62-f8g4-4wqh"}],"summary":"phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold"}