CVE-2026-111909: phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.9
Event History
Frequently Asked Questions
Which accounts are able to exploit this issue?
An attacker must be authenticated as a non-superadmin user and have the delete_user permission. No user interaction is required, and the vulnerable API endpoint is reachable over the network.
Are all superadmin accounts affected?
The vulnerable deleteUser() API can be used to delete a superadmin account whose userId is not 1. The provided information does not indicate that the account with userId 1 can be deleted through this issue.
How can I check whether a system is vulnerable?
Systems running phpMyFAQ versions before 4.1.9 are affected. Review the deployed phpMyFAQ version and identify non-superadmin accounts that have the delete_user permission.
What is the immediate mitigation if upgrading is not possible?
Restrict or remove the delete_user permission from non-superadmin accounts to prevent them from invoking the vulnerable deletion capability. Monitor requests to /admin/api/user/delete and review superadmin accounts for unexpected deletions.