CVE-2026-124433 · Package
NO FIX YET · SEE WHAT TO DO
phpMyFAQ before 4.1.11 lets a delegated administrator who only holds the GROUP_DELETE permission delete more privileged groups. Deleting those groups also removes their memberships and permission mappings.
first public Oct 23, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running phpMyFAQ before 4.1.11 where some administrators are delegated the GROUP_DELETE permission. The flaw is in the admin group deletion flow, so installations without delegated administrators have less exposure. unknown whether the sources list other conditions.
Not affected if no-delegated-admins, phpmyfaq-4.1.11-or-later
Who cares php, phpmyfaq, self-hosted
4.1.11 or later, per the product description (before 4.1.11 is affected).phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.