High severity8.1NVD Advisory· Published Oct 17, 2026· Updated Oct 17, 2026
CVE-2026-111909
CVE-2026-111909
Description
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <4.1.9
Patches
Vulnerability mechanics
References
2News mentions
1- PhpMyFAQ: 25 Vulnerabilities Including Critical Auth Bypass Disclosed TogetherVypr Intelligence · Oct 17, 2026