Medium severity5.5NVD Advisory· Published Oct 17, 2026· Updated Oct 17, 2026

CVE-2026-111885

Description

phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.

Affected products

PhpMyAdmin/Phpmyfaqllm-create
Range: 4.2.0-alpha to <4.2.0-beta
Thorsten/Phpmyfaqllm-fuzzy
Range: 4.2.0-alpha to <4.2.0-beta

Patches

Vulnerability mechanics

References

github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjhnvd
www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-deletegroup-apinvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000