CVE-2026-124433

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUPDELETE permission to delete higher-privileged groups. Attackers can submit a target grouplistselect value to /admin/group/confirm and then /admin/group/delete to remo...

PT-2026-139949

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP DELETE permission to delete higher-privileged groups. Attackers can submit a target group list select value to /admin/group/confirm and then /admin/group/delete to...