Is CVE-2026-124433 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124433 being exploited in the wild.

How severe is CVE-2026-124433?

Medium severity, with a CVSS score of 6.5, published 8 November 2026.

Which products and versions are affected?

Thorsten phpMyFAQ before 4.1.11.

How is CVE-2026-124433 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-124433?

Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124433: phpMyFAQ insufficient authorization in group deletion

CVE-2026-124433 · Severity: medium · CVSS 6.5 · Published 2026-11-08

phpMyFAQ is a frequently-asked-questions management system used to build knowledge bases. A delegated administrator with only the permission to delete groups can exploit an authorization flaw to delete groups with higher privileges than they possess, removing admin access and disrupting the system's access control structure. This requires authentication but no special interaction beyond submitting a form with the target group ID.

Technologies: Thorsten phpMyFAQ. Vendors: Thorsten.

Quick answers

Is CVE-2026-124433 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124433 being exploited in the wild.
How severe is CVE-2026-124433?: Medium severity, with a CVSS score of 6.5, published 8 November 2026.
Which products and versions are affected?: Thorsten phpMyFAQ before 4.1.11.
Is there a fix for CVE-2026-124433?: Yes: fixed in 4.1.11. Until then: Restrict group deletion to SuperAdmin accounts only, or ensure that confirmation and deletion endpoints independently verify the actor holds every permission assigned to the target group before allowing deletion. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124433 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-124433?: Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.1.11

Restrict group deletion to SuperAdmin accounts only, or ensure that confirmation and deletion endpoints independently verify the actor holds every permission assigned to the target group before allowing deletion.

Technical details

The vulnerability is an insufficient authorization flaw in phpMyFAQ's GroupController where the confirm() and delete() endpoints check only for GROUP_DELETE permission but do not verify the actor holds all permissions assigned to the target group. An authenticated delegated administrator can craft a POST request to /admin/group/confirm and /admin/group/delete with an attacker-controlled group_list_select value to delete higher-privileged groups and their permission mappings, bypassing the authorization checks present in other group management operations.

Affected products

thorsten phpMyFAQ before 4.1.11

Timeline

2026-10-23: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.