{"id":"CVE-2026-124433","kind":"vulnerability","aliases":["CVE-2026-124433"],"related":[],"title":"phpMyFAQ: delegated admins can delete higher-privileged groups before 4.1.11","description":"phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.","summary":"phpMyFAQ before 4.1.11 lets a delegated administrator who only holds the GROUP_DELETE permission delete more privileged groups. Deleting those groups also removes their memberships and permission mappings.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["no-delegated-admins","phpmyfaq-4.1.11-or-later"],"how_to_check":"- Check the installed phpMyFAQ version in the application's composer.json or the admin footer; unknown whether the sources name an exact check beyond this.\n- Review which accounts hold only the GROUP_DELETE permission in the admin user and group settings.","fix":"- phpMyFAQ `4.1.11` or later, per the product description (before 4.1.11 is affected).","status":"open","published_at":"2026-11-08T14:18:09+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","triaged_at":"2026-11-08T14:50:52+00:00","updated_at":"2026-11-08T14:50:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T14:50:52Z","model":"claude-haiku-5-5","output":{"fix":"- phpMyFAQ `4.1.11` or later, per the product description (before 4.1.11 is affected).","reach":"internet","title":"phpMyFAQ: delegated admins can delete higher-privileged groups before 4.1.11","impact":"medium","summary":"phpMyFAQ before 4.1.11 lets a delegated administrator who only holds the GROUP_DELETE permission delete more privileged groups. Deleting those groups also removes their memberships and permission mappings.","audience":"businesses","category":"package","nicknames":[],"who_cares":["phpmyfaq","self-hosted","php"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Privileged groups and their permission mappings are deleted by a delegated admin","analyst_note":"Confirm the exact affected version range and any vendor advisory details at the linked vendor advisory and VulnCheck page.","how_to_check":"- Check the installed phpMyFAQ version in the application's composer.json or the admin footer; unknown whether the sources name an exact check beyond this.\n- Review which accounts hold only the GROUP_DELETE permission in the admin user and group settings.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["phpmyfaq-4.1.11-or-later","no-delegated-admins"],"who_is_affected":"Teams running phpMyFAQ before 4.1.11 where some administrators are delegated the GROUP_DELETE permission. The flaw is in the admin group deletion flow, so installations without delegated administrators have less exposure. unknown whether the sources list other conditions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000769,"input_tokens":4617,"output_tokens":614,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124433':14A,17A '-2026':13A,16A '/admin/group/confirm':85C '/admin/group/delete':88C '4.1.11':11A,26B,54C 'admin':3A 'administr':30B,63C 'allow':61C 'also':45B 'attack':75C 'author':58C 'contain':55C 'cve':12A,15A 'deleg':2A,29B,62C 'delet':5A,36B,38B,42B,67C,70C 'group':9A,35B,41B,44B,66C,74C,80C,92C 'higher':7A,72C 'higher-privileg':6A,71C 'hold':33B,64C 'host':23B 'insuffici':57C 'let':27B 'list':81C 'map':51B,97C 'membership':48B,94C 'packag':18B 'permiss':37B,50B,68C,96C 'php':19B 'phpmyfaq':1A,20B,24B,52C 'privileg':8A,40B,73C,91C 'remov':46B,90C 'select':82C 'self':22B 'self-host':21B 'submit':77C 'target':79C 'valu':83C 'vulner':59C","nicknames":[],"mitigations":[],"who_affected":"Teams running phpMyFAQ before 4.1.11 where some administrators are delegated the GROUP_DELETE permission. The flaw is in the admin group deletion flow, so installations without delegated administrators have less exposure. unknown whether the sources list other conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","php","phpmyfaq","selfhosted"],"campaign_type":null,"search_a":"'-124433':14A,17A '-2026':13A,16A '4.1.11':11A 'admin':3A 'cve':12A,15A 'deleg':2A 'delet':5A 'group':9A 'higher':7A 'higher-privileg':6A 'phpmyfaq':1A 'privileg':8A","search_b":"'4.1.11':26B 'administr':30B 'also':45B 'deleg':29B 'delet':36B,38B,42B 'group':35B,41B,44B 'hold':33B 'host':23B 'let':27B 'map':51B 'membership':48B 'packag':18B 'permiss':37B,50B 'php':19B 'phpmyfaq':20B,24B 'privileg':40B 'remov':46B 'self':22B 'self-host':21B","search_c":"'/admin/group/confirm':85C '/admin/group/delete':88C '4.1.11':54C 'administr':63C 'allow':61C 'attack':75C 'author':58C 'contain':55C 'deleg':62C 'delet':67C,70C 'group':66C,74C,80C,92C 'higher':72C 'higher-privileg':71C 'hold':64C 'insuffici':57C 'list':81C 'map':97C 'membership':94C 'permiss':68C,96C 'phpmyfaq':52C 'privileg':73C,91C 'remov':90C 'select':82C 'submit':77C 'target':79C 'valu':83C 'vulner':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-23T14:45:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124433","severity":null,"published_at":"2026-11-08T14:18:09+00:00","modified_at":"2026-11-08T14:18:09+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","fetched_at":"2026-11-08T14:48:38+00:00","note":null}],"documents":[{"id":102050,"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T14:45:00+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102051,"url":"https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.11-insufficient-authorization-in-group-deletion-via-groupcontroller","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}