Live › vulnerability › CVE-2026-111909
Go to dashboardphpMyFAQ before 4.1.9 fails to check authorization in its deleteUser() API, so a non-superadmin user with the delete_user permission can delete superadmin accounts other than user ID 1. An attacker who holds that permission can remove administrative access and erase accountability.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted phpMyFAQ installations running a version before 4.1.9 that have users granted the delete_user permission. Installations with no non-superadmin users holding that permission have a much smaller exposure, and managed hosts that patch on their own schedule should confirm their version.
No product ranges from the sources yet.
grep -r "VERSION" phpmyfaq/src/phpMyFAQ/Version.php or the admin panel footer; unknown if the sources give a different path.4.1.9 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.
This page as .md · .json · in your agent: get_signal("CVE-2026-111909")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.