CVE-2026-111885 Details
Description
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.
A missing authorization vulnerability has been identified in phpMyFAQ versions 4.2.0-alpha prior to 4.2.0-beta. The issue resides in the GroupController's deleteGroup() method, which fails to perform necessary privilege-level checks on groups being deleted. This vulnerability allows authenticated administrators, who are not SuperAdmins but hold the GROUP_DELETE right, to delete higher-privileged groups. Exploitation of this flaw removes the group's members and their associated rights, effectively disrupting the application's permission management system.
phpMyFAQ has released a patch for this vulnerability in version 4.2.0-beta. Users are advised to update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-deletegroup-api | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1220 | Insufficient Granularity of Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | >= 4.2.0-alpha, <= 4.2.0-alpha.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |