{"id":"CVE-2026-111885","published":"2026-10-17T19:16:29.610","lastModified":"2026-10-17T19:16:29.723","description":"phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.","cvssScore":5.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","cwes":["CWE-1220"],"vendors":[],"products":[],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh","tags":[]},{"url":"https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-deletegroup-api","tags":[]}],"exploitRefs":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh","tags":[]}],"hasPoc":true,"ai":null}