medium5.5
CVE-2026-111885
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks …
Impact
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.
Affected products
| Product | Affected versions |
|---|---|
| PhpMyFAQ From 4.2.0-Alpha | before 4.2.0-beta |
Versions were read from the advisory text. No structured product data has been published for this record yet.