phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.

CVSS Details

CVSS 4.0 Base Score: 7 (HIGH)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 6.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

CVSS Details

Prioritize with Active Threat Intelligence

MDR Buyer's Guide

Global Threat Landscape Report

CVE-2026-124433: thorsten phpMyFAQ: phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators…

CVSS Details

Prioritize with Active Threat Intelligence