CVE-2026-124433: phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupController

Published Nov 8, 2026

Updated

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUPDELETE permission to delete higher-privileged groups. Attackers can submit a target grouplistselect value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade phpMyFAQ to a version that resolves this vulnerability.
Fixed in 4.1.11

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A delegated administrator with the GROUP_DELETE permission can exploit it. No user interaction is required, and the attacker can reach the affected administrative endpoints over the network.

What is the impact of a successful exploit?

The attacker can delete groups with higher privileges than their own. Deleting a group also removes its memberships and permission mappings, which can cause unauthorized disruption of access control.

Which requests are involved in the attack?

The attacker submits a chosen target group_list_select value to /admin/group/confirm and then to /admin/group/delete. The affected authorization check does not prevent selection of a higher-privileged target group.

What versions are affected?

phpMyFAQ versions before 4.1.11 are affected. Updating to 4.1.11 or later addresses the affected version range described here.

CVE-2026-124433: phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupController

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of a successful exploit?

Which requests are involved in the attack?

What versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of a successful exploit?

Which requests are involved in the attack?

What versions are affected?