# CVE-2026-111909: phpMyFAQ missing authorization in deleteUser API

Source: https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111909 · Severity: high · CVSS 8.1 · Published 2026-10-17

phpMyFAQ is a frequently asked questions knowledge base system used by organizations to document and share information. A flaw in the user management API allows authenticated staff with limited permissions to delete superadmin accounts, which removes administrative access and eliminates accountability for system actions.

Technologies: [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-111909 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111909 being exploited in the wild.

**How severe is CVE-2026-111909?** High severity, with a CVSS score of 8.1, published 17 October 2026.

**Which products and versions are affected?** Thorsten phpMyFAQ before 4.1.9.

**Is there a fix for CVE-2026-111909?** Yes: fixed in 4.1.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111909 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111909?** Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.1.9

## Technical details

A missing authorization check in the deleteUser() API endpoint (DELETE /admin/api/user/delete) fails to verify whether the target user is a superadmin before deletion. An authenticated non-superadmin user with the delete_user permission can exploit this by sending a DELETE request with a superadmin's userId to completely remove that account from the system. The vulnerability exists in src/phpMyFAQ/Controller/Administration/Api/UserController.php and affects versions before 4.1.9.

## Affected products

- thorsten phpMyFAQ before 4.1.9

## Timeline

- 2026-10-03: disclosed
- 2026-10-17: advisory

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7j43-ww55-pm3g](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7j43-ww55-pm3g)
- [https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-missing-authorization-allows-superadmin-deletion-via-deleteuser-api](https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-missing-authorization-allows-superadmin-deletion-via-deleteuser-api)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)
- [phpMyFAQ cross-site request forgery in database update endpoint](https://junglewise.ai/threats/cve-2026-111907-phpmyfaq-4-0-0-before-4-1-9-contains-a-cross-site-request)