# CVE-2026-124433: phpMyFAQ insufficient authorization in group deletion

Source: https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-124433 · Severity: medium · CVSS 6.5 · Published 2026-11-08

phpMyFAQ is a frequently-asked-questions management system used to build knowledge bases. A delegated administrator with only the permission to delete groups can exploit an authorization flaw to delete groups with higher privileges than they possess, removing admin access and disrupting the system's access control structure. This requires authentication but no special interaction beyond submitting a form with the target group ID.

Technologies: [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-124433 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124433 being exploited in the wild.

**How severe is CVE-2026-124433?** Medium severity, with a CVSS score of 6.5, published 8 November 2026.

**Which products and versions are affected?** Thorsten phpMyFAQ before 4.1.11.

**Is there a fix for CVE-2026-124433?** Yes: fixed in 4.1.11. Until then: Restrict group deletion to SuperAdmin accounts only, or ensure that confirmation and deletion endpoints independently verify the actor holds every permission assigned to the target group before allowing deletion. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124433 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-124433?** Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.1.11

Restrict group deletion to SuperAdmin accounts only, or ensure that confirmation and deletion endpoints independently verify the actor holds every permission assigned to the target group before allowing deletion.

## Technical details

The vulnerability is an insufficient authorization flaw in phpMyFAQ's GroupController where the confirm() and delete() endpoints check only for GROUP_DELETE permission but do not verify the actor holds all permissions assigned to the target group. An authenticated delegated administrator can craft a POST request to /admin/group/confirm and /admin/group/delete with an attacker-controlled group_list_select value to delete higher-privileged groups and their permission mappings, bypassing the authorization checks present in other group management operations.

## Affected products

- thorsten phpMyFAQ before 4.1.11

## Timeline

- 2026-10-23: disclosed
- 2026-11-08: advisory

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwq](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwq)
- [https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.11-insufficient-authorization-in-group-deletion-via-groupcontroller](https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.11-insufficient-authorization-in-group-deletion-via-groupcontroller)

## Related threats

- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)
- [phpMyFAQ cross-site request forgery in database update endpoint](https://junglewise.ai/threats/cve-2026-111907-phpmyfaq-4-0-0-before-4-1-9-contains-a-cross-site-request)