CVE-2026-111885: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUPDELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated administrator who is not a SuperAdmin can exploit it if their account has the GROUP_DELETE permission. The attacker must be able to send a crafted groupId request to the /admin/api/group/delete endpoint.
What is the impact of successful exploitation?
The attacker can permanently delete groups with higher privilege levels than their own. Deleting those groups can remove members' inherited rights and may cause service disruption through loss of group-based access.
Which releases are affected?
The issue affects phpMyFAQ 4.2.0-alpha releases before 4.2.0-beta. The provided information does not identify affected stable releases or a specific fixed release beyond 4.2.0-beta.