All vulnerabilities
CVE-2026-111909GHSA-7j43-ww55-pm3g

phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API

thorsten phpMyFAQ
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.1.9Fixed versionCVE List
Published17 Oct 2026Updated 18 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.

Text from CVE List

Affected versions 2

  • phpMyFAQaffected: all versions before 4.1.9CVE List
  • phpMyFAQunaffected: 4.1.9CVE List

References 2