CVE-2026-111909 in phpMyFAQ
Summary
by MITRE • 10/17/2026
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The identified vulnerability in phpMyFAQ versions prior to 4.1.9 represents a critical failure in server-side access control mechanisms, specifically within the deleteUser API endpoint. This flaw is classified under CWE-285, which describes Improper Authorization, where an application fails to properly verify that a user has sufficient privileges for a requested action. The core technical issue lies in the insufficient validation of the target resource against the permissions of the authenticated actor. While the system correctly restricts certain administrative functions based on role hierarchy, it neglects to enforce strict boundaries when processing deletion requests via the API interface. Consequently, an attacker who possesses valid credentials and the delete_user permission can bypass intended security controls by directly manipulating the userId parameter in a DELETE request directed at /admin/api/user/delete.
From an operational perspective, this vulnerability allows authenticated non-superadmin users with specific administrative privileges to escalate their impact significantly beyond what is typically expected for their role level. By targeting superadmin accounts identified by any user ID other than 1, attackers can permanently remove high-privilege entities from the system. This action effectively strips the organization of its primary administrative oversight capabilities, leading to a complete loss of accountability and control over the content management platform. The ability to delete these critical accounts disrupts business continuity, as it may lock out legitimate administrators or create confusion regarding who holds ultimate responsibility for the system's configuration and data integrity.
The exploitation vector aligns with MITRE ATT&CK technique T1078, Valid Accounts, specifically focusing on Local Account manipulation. An attacker leverages existing valid credentials to perform unauthorized modifications that compromise the availability and integrity of administrative functions. The impact extends beyond simple account removal; it undermines the audit trail and security posture by eliminating the entities responsible for monitoring system activities and enforcing policies. This type of vulnerability is particularly dangerous in multi-tenant or shared hosting environments where role-based access control is expected to be robust, as it allows lower-level administrators to destabilize the entire deployment without requiring further privilege escalation exploits.
Mitigation strategies must prioritize immediate patching to version 4.1.9 or later, which addresses this authorization logic flaw by implementing stricter checks on resource ownership and permission levels during API execution. In addition to updating software, organizations should enforce strict role-based access control policies that limit the delete_user capability exclusively to superadmin roles where such power is absolutely necessary for operational requirements. Implementing additional monitoring through intrusion detection systems can help identify anomalous patterns of DELETE requests targeting high-privilege accounts from lower-level user sessions. Furthermore, adopting a principle of least privilege ensures that administrative functions are distributed carefully, reducing the blast radius if any single account or role is compromised by an insider threat or external attacker leveraging stolen credentials.