CVE-2026-111885

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha

Description An authorization flaw exists in the deleteGroup() function of the GroupController. Authenticated administrators who possess the GROUP DELETE privilege but are not SuperAdmins can exploit this by sending a crafted groupId to the '/admin/api/group/delete' endpoint. This allows the deletion of groups with higher privilege levels, resulting in the permanent removal of those groups and the loss of inherited rights for their members.

Recommendations Update phpMyFAQ to version 4.2.0-beta or later. As a temporary mitigation, restrict the GROUP DELETE privilege to only SuperAdmin accounts.