HIGH 7.0 NVD
CVE-2026-124433
phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete
phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwq
- https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.11-insufficient-authorization-in-
This high severity vulnerability with a CVSS score of 7.0 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.