phpMyFAQ CVE-2026-111885

Requires an authenticated phpMyFAQ administrator account that is NOT a SuperAdmin but has been explicitly granted the GROUP_DELETE permission; the attacker then sends a crafted groupId to the /admin/api/group/delete endpoint. Limiting factors: it is not exploitable by anonymous users, standard end-users, or admins lacking GROUP_DELETE, so exposure depends on deployments that delegate group management to multiple lower-tier administrators - single-SuperAdmin installations have little attack surface. No user interaction beyond the attacker's own authenticated request is needed (UI:N), and affected versions are limited to the 4.2.0-alpha-through-pre-4.2.0-beta development line.

This is a moderate-priority, authorization-model flaw (CWE-1220) in phpMyFAQ rather than a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:N/VI:L/VA:H) and 7.0 base score are internally consistent with the description: exploitation is network-reachable and low-complexity, but gated behind PR:H - the attacker must already hold an authenticated administrator session with the GROUP_DELETE permission. Impact is weighted toward availability (VA:H, permanent destruction of higher-privileged groups) and integrity (VI:L, stripping members' inherited rights), with no confidentiality impact (VC:N). No EPSS score was supplied, and there is no CISA KEV listing and no public exploit referenced, so exploitation status is 'no public exploit identified at time of analysis' - the risk is driven by a privileged insider or a compromised delegated-admin account abusing privilege escalation, not opportunistic internet-wide scanning. Note a signal tension: the 'Information Disclosure' tag conflicts with the vector's VC:N (no confidentiality impact); the actual harm is availability/integrity (group deletion and rights revocation), so treat the disclosure framing as inaccurate. Overall this warrants timely patching in environments that delegate group-management to non-SuperAdmin administrators, but is not an emergency for single-admin or unexposed deployments.

A non-SuperAdmin administrator (or an attacker who has hijacked such a delegated admin account) who was granted only the GROUP_DELETE permission sends a crafted groupId to /admin/api/group/delete targeting a higher-privileged group. Because deleteGroup() omits the privilege-level check on the target, the request succeeds, permanently destroying the superior group and stripping its members' inherited rights. No public exploit code or active exploitation is identified at time of analysis; the flaw is trivially reproducible given the required admin privilege.