{"id":"CVE-2026-124433","title":"phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupController","summary":"phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select val…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","cvssSource":"cna","cwe":["CWE-863"],"vendor":"thorsten","product":"phpMyFAQ","affected":["phpMyFAQ < 4.1.11"],"published":"2026-11-08","updated":"2026-11-08","sourceUpdated":"2026-11-08T13:15:28.799Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-124433","references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwq","label":"GitHub Security Advisory (GHSA-jprf-xpcq-vjwq)"},{"url":"https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.11-insufficient-authorization-in-group-deletion-via-groupcontroller","label":"VulnCheck Advisory: phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupController"}],"tags":["cve.org"],"ingestedAt":"2026-11-08T13:50:34.988Z","slug":"CVE-2026-124433","body":"## Overview\n\nphpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.\n\n## Affected\n\n- `phpMyFAQ < 4.1.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}