CVE-2026-124433 Details
Description
phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.
A vulnerability exists in phpMyFAQ versions prior to 4.1.11, allowing delegated administrators with only GROUP_DELETE permission to delete higher-privileged groups. This is achieved by submitting a target group identifier to the group deletion confirmation and deletion endpoints. The vulnerability arises because the deletion process does not properly verify whether the administrator has the necessary permissions to manage the selected group, leading to unauthorized deletions of groups, their members, and associated permissions.
Users can upgrade to phpMyFAQ version 4.1.11 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwq | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.11-insufficient-authorization-in-group-deletion-via-groupcontroller | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | >= 0, < 4.1.11 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |