CVE-2026-111885
Deferred Deferred - Pending Action

phpMyFAQ Group Deletion Authorization Bypass

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111885
EUVD
EUVD-2026-103334

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thorsten phpMyFAQ 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1220 The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization flaw in phpMyFAQ versions 4.2.0-alpha through 4.2.0-beta. The GroupController::deleteGroup() function fails to check privilege levels when deleting groups. Authenticated non-SuperAdmin administrators with GROUP_DELETE permissions can exploit this by sending a crafted groupId to /admin/api/group/delete to permanently delete higher-privileged groups and strip inherited rights from members.

Detection Guidance

Monitor API requests to /admin/api/group/delete for unauthorized deletion attempts. Check phpMyFAQ logs for POST requests with groupId parameters from non-SuperAdmin users. Use network traffic analysis tools to inspect HTTP POST requests targeting the deleteGroup endpoint.

Impact Analysis

An attacker with GROUP_DELETE permissions could delete critical groups, disrupting access control and removing permissions from users. This could lead to unauthorized access, data loss, or system unavailability if key groups are deleted. The impact includes integrity and availability issues as per CVSS scores.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data integrity, such as GDPR's principle of least privilege or HIPAA's access control safeguards. Unauthorized group deletion may lead to unauthorized data access or loss of audit trails.

Mitigation Strategies

Upgrade phpMyFAQ to a version beyond 4.2.0-beta where this vulnerability is patched. Temporarily revoke GROUP_DELETE permissions from non-SuperAdmin administrators until patched. Implement strict input validation on groupId parameters in API requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111885. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart