CVE-2026-124433

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUPDELETE permission to delete higher-privileged groups. Attackers can submit a target grouplistselect value to /admin/group/confirm and then /admin/group/delete to remo...

EUVD-2026-119567

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUPDELETE permission to delete higher-privileged groups. Attackers can submit a target grouplistselect value to /admin/group/confirm and then /admin/group/delete to remo...

CVE-2026-124433

The software phpMyFAQ before version 4.1.11 is susceptible to an insufficient authorization vulnerability in the GroupController . This flaw allows delegated administrators possessing only the GROUP_DELETE permission to delete higher-privileged groups. An attacker can exploit this by submitting a...

CVE-2026-124433: thorsten phpMyFAQ: phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators…

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUPDELETE permission to delete higher-privileged groups. Attackers can submit a target grouplistselect value to /admin/group/confirm and then /admin/group/delete to remo...