GHSA-985r-q3qp-299h

## Advisory / Disclosure # phpMyFAQ 4.1.3 — incomplete fix for the admin-API IDOR/privilege-escalation class **Target:** thorsten/phpMyFAQ (composer: `thorsten/phpmyfaq`, `phpmyfaq/phpmyfaq`) **Affected:** <= 4.1.3 (the 4.1.3 security fix is incomplete; siblings remain) **Class:** CWE-862 Missing Authorization / CWE-269 Improper Privilege Management / CWE-639 Authorization Bypass Through User-Controlled Key **Methodology:** M1 incomplete-fix audit (sibling-walk of the 4.1.3 fix for GHSA-xvp4-phqj-cjr3) **Severity:** High — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 (same class as the parent CVE) ## Summary phpMyFAQ 4.1.3 fixed **GHSA-xvp4-phqj-cjr3** ("IDOR Account Takeover") by adding actor-authorization guards to `UserController::overwritePassword()`. The patch establishes a new invariant, stated in its own code comments: > "Only SuperAdmins may change other users' [attributes]. Self-service is > always allowed." and "a non-SuperAdmin must never be able to alter a > SuperAdmin or protected account." That invariant is **not enforced** on two sibling endpoints in the *same file*, which the 4.1.3 fix left **unchanged**, and which carry the identical "user-controlled `userId` → `getUserById()` → privileged mutation" primitive — but with a strictly more dangerous sink: | Endpoint | Route | Sink | Guard in 4.1.3 | |----------|-------|------|----------------| | `overwritePassword()` | `admin/api/user/overwrite-password` | `changePassword()` | **isSelf + isSuperAdmin + target-protection** (patched) | | `editUser()` | `admin/api/user/edit` | `setSuperAdmin((bool)$req.is_superadmin)` | **none** (only `userHasPermission(USER_EDIT)`) | | `updateUserRights()` | `admin/api/user/update-rights` | `grantUserRight($req.userId, …)` | **none** (only `userHasPermission(USER_EDIT)`) | A logged-in administrator holding the delegable `edit_user` right — but **not** SuperAdmin — can therefore: 1. Set their own (or anyone's) `is_superadmin` flag to `true` via `admin/api/u