Medium severity6.5NVD Advisory· Published Nov 8, 2026· Updated Nov 8, 2026

CVE-2026-124433

Description

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.

Affected products

PhpMyAdmin/Phpmyfaqllm-create
Range: <4.1.11

Patches

Vulnerability mechanics

References

github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwqnvd
www.vulncheck.com/advisories/phpmyfaq-before-4.1.11-insufficient-authorization-in-group-deletion-via-groupcontrollernvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000