Live › vulnerability › CVE-2026-111885
Go to dashboardphpMyFAQ 4.2.0-alpha before 4.2.0-beta lets an authenticated administrator with the GROUP_DELETE right delete groups above their privilege level by sending a crafted groupId to the group delete endpoint. Deleting those groups permanently removes them and strips inherited rights from their members.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations of phpMyFAQ from 4.2.0-alpha up to but not including 4.2.0-beta are affected. The attacker needs an admin account that holds the GROUP_DELETE right but is not SuperAdmin, so instances with only SuperAdmin accounts or no delegated group-delete rights carry much less risk.
No product ranges from the sources yet.
4.2.0-alpha and 4.2.0-beta.4.2.0-beta or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.
This page as .md · .json · in your agent: get_signal("CVE-2026-111885")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.