CVE-2026-124433
Deferred Deferred - Pending Action

Insufficient Authorization in phpMyFAQ Allows Privileged Group Deletion

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124433
EUVD
EUVD-2026-119567

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in phpMyFAQ before version 4.1.11 allows delegated administrators with only GROUP_DELETE permission to delete higher-privileged groups. Attackers can exploit this by submitting a target group_list_select value to /admin/group/confirm and /admin/group/delete endpoints, which removes privileged groups along with their memberships and permission mappings.

Detection Guidance

Check phpMyFAQ logs for suspicious activity in /admin/group/confirm and /admin/group/delete endpoints. Monitor for unauthorized group deletions or privilege changes. Review access logs for users with GROUP_DELETE permission accessing higher-privileged groups.

Impact Analysis

This vulnerability can lead to administrative access revocation, corruption of the intended access control list structure, and potential administrative disruption. It requires SuperAdmin or database operator intervention to restore affected groups and permissions.

Compliance Impact

This vulnerability could lead to unauthorized deletion of privileged groups, potentially causing loss of access controls and data integrity. For GDPR, this may violate Article 32 (security of processing) if it results in unauthorized data access or loss. For HIPAA, it could compromise access controls under the Security Rule, potentially leading to unauthorized PHI exposure or integrity breaches.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.11 or later immediately. Remove GROUP_DELETE permission from non-SuperAdmin users. Audit all group permissions and memberships after upgrade. Implement strict access controls and monitor for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124433. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...