[HIGH] phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

PKSA-hycs-5t33-gw1y GHSA-pg62-f8g4-4wqh

Affected version: <=4.1.4

Reported by:
GitHub

[MEDIUM] phpMyFAQ public FAQ APIs expose inactive FAQ content

PKSA-5ym8-q7sn-cqmx GHSA-mf8r-wm2w-f8c5

Affected version: >=4.1.0,<=4.1.4

Reported by:
GitHub

[MEDIUM] phpMyFAQ has Potential Authenticated Path Traversal in PDF Export

PKSA-wqvs-f8jk-pt53 GHSA-88g4-74f3-63x9

Affected version: >=4.0.0-alpha,<=4.1.4

Reported by:
GitHub

[MEDIUM] phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

PKSA-cz4f-38kk-4ywj CVE-2026-47132 GHSA-6pvm-2vjj-rx4w

Affected version: <4.2.0-alpha

Reported by:
GitHub