{"id":"CVE-2026-124433","published":"2026-11-08T14:18:09.487","lastModified":"2026-11-08T14:18:09.610","description":"phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwq","tags":[]},{"url":"https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.11-insufficient-authorization-in-group-deletion-via-groupcontroller","tags":[]}],"exploitRefs":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwq","tags":[]}],"hasPoc":true,"ai":null}