CVE-2026-124433

6.5 MEDIUMpublic exploit available

Published 2026-11-08 · Updated 2026-11-08

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-863

Public exploit & PoC references

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwq

All references

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwq
https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.11-insufficient-authorization-in-group-deletion-via-groupcontroller

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2024-22031PoC
MEDIUMCVE-2025-13050PoC
UNSCOREDCVE-2025-68392
HIGHCVE-2026-100105
MEDIUMCVE-2026-100145
UNSCOREDCVE-2026-100252
MEDIUMCVE-2026-100259
HIGHCVE-2026-100262

Related by shared AI tags and CWE weakness class. Browse the full archive.