# CVE-2026-111885: phpMyFAQ missing authorization in deleteGroup API

Source: https://junglewise.ai/threats/cve-2026-111885-phpmyfaq-from-4-2-0-alpha-before-4-2-0-beta-contains-a-missing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111885 · Severity: medium · CVSS 5.5 · Published 2026-10-17

phpMyFAQ is a web-based FAQ management system that uses role-based access control to protect sensitive administrative functions. A flaw in the group deletion API allows authenticated non-administrator accounts with deletion rights to permanently delete higher-privileged groups and strip other users of their inherited permissions, even though the attacker could not normally access or manage those groups. This enables destructive interference with the application's permission infrastructure by lower-privileged administrators.

Technologies: [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-111885 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111885 being exploited in the wild.

**How severe is CVE-2026-111885?** Medium severity, with a CVSS score of 5.5, published 17 October 2026.

**Which products and versions are affected?** Thorsten phpMyFAQ 4.2.0-alpha through 4.2.0-alpha.2.

**Is there a fix for CVE-2026-111885?** Yes: fixed in 4.2.0-beta. Until then: Restrict GROUP_DELETE permission to SuperAdmin accounts only until patching, or disable group permissions mode (switch to legacy permission model) if group-based access control is not required for your deployment. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111885 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111885?** Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.2.0-beta

Restrict GROUP_DELETE permission to SuperAdmin accounts only until patching, or disable group permissions mode (switch to legacy permission model) if group-based access control is not required for your deployment.

## Technical details

The GroupController::deleteGroup() endpoint enforces only a binary permission check for GROUP_DELETE, omitting the privilege-level comparison that sibling endpoints (updateGroup, updateMembers, updatePermissions) perform. An authenticated non-SuperAdmin attacker holding GROUP_DELETE can send a crafted POST request to /admin/api/group/delete with a target groupId to bypass authorization and execute unconditional SQL deletion of the group, its memberships, and its rights assignments. The vulnerability requires an authenticated admin session with GROUP_DELETE rights and group permissions mode enabled; no privilege escalation to new rights occurs, but the attacker gains unauthorized destruction of higher-privileged groups.

## Affected products

- thorsten phpMyFAQ 4.2.0-alpha through 4.2.0-alpha.2

## Timeline

- 2026-10-03: disclosed
- 2026-10-17: advisory

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh)
- [https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-deletegroup-api](https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-deletegroup-api)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)