CVE-2026-124433 in phpMyFAQinfo

Summary

by MITRE • 11/08/2026

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsible

VulnCheck

Reservation

11/08/2026

Disclosure

11/08/2026

Moderation

accepted

EPSS

0.00000

KEV

no

Activities

very low

Sector

Agriculture, Lawfirm, ...

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-124433
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-124433
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-124433/

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!