EUVD-2026-103311
GHSA-2jrh-wx9p-9fp9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as non-superadmin with delete_user permission
-
ExploitSend DELETE to /admin/api/user/delete with superadmin userId > 1
-
ExecutionMissing authorization check passes
-
ImpactSuperadmin account removed, administrative access and accountability destroyed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated phpMyFAQ (before 4.1.9) account that has been granted the delete_user permission but is NOT a superadmin - this specific permission grant is the key prerequisite and the main limiting factor. The attacker must target a superadmin whose userId is greater than 1 (userId 1 is protected). No user interaction, no special network configuration, and no non-default setup beyond the existence of multiple admin-tier accounts are needed; the limiting factors are the required authenticated low-privilege session and possession of the delete_user permission, so single-superadmin or tightly-controlled-permission deployments are not realistically exposed. |
| Impact | The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) scoring 7.2 HIGH is internally consistent with the description: network-reachable API, low complexity, and crucially PR:L - the attacker must already hold an authenticated account with the delete_user permission. This is NOT a pre-auth remote flaw; it is a privilege-escalation/authorization-bypass (CWE-269) that lets a trusted-but-limited admin user exceed their intended role boundary. No EPSS score, KEV listing, or POC is provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is primarily insider or post-compromise lateral escalation rather than mass internet exploitation. The VC:N (no confidentiality impact) is accurate: the bug deletes accounts rather than reading data; the real damage is integrity/availability of the administrative tier (removing superadmin access and audit accountability). Net: a legitimate HIGH-severity authorization gap worth patching promptly where multiple admin-tier users exist, but the PR:L prerequisite meaningfully caps real-world risk versus an unauthenticated RCE. |
| Exploit ScenarioDerived | A non-superadmin user who has been granted the delete_user permission (e.g., a help-desk or junior admin) authenticates to the phpMyFAQ admin panel and issues a DELETE request to /admin/api/user/delete specifying a superadmin's userId greater than 1. The missing authorization check lets the request succeed, destroying the superadmin account and erasing administrative accountability. No public POC is referenced, but the attack is a single trivially-craftable API call once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 17, 2026
Missing authorization in phpMyFAQ before 4.1.9 allows authenticated non-superadmin accounts that hold the delete_user permission to delete superadmin users and strip administrative accountability from the application. The /admin/api/user/delete endpoint accepts a superadmin userId other than the protected userId 1, so an attacker with a low-privilege admin session can remove higher-privileged administrators; confidentiality is unaffected while integrity and availability impacts are high. No public exploit was identified at time of analysis, and exploitation is gated by the specific delete_user permission rather than being available to every authenticated user.
RemediationAI
Upgrade to phpMyFAQ 4.1.9 or later (vendor-released patch: 4.1.9) per the advisory at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7j43-ww55-pm3g. If immediate upgrade is not possible, remove the delete_user permission from all non-superadmin roles and/or restrict /admin/api/user/delete to superadmin-only access at the reverse proxy or application layer; both controls can disrupt legitimate delegated user-management workflows, so audit admin roles first. Do not rely on the userId 1 protection as a general safeguard, review and alert on deletion events for superadmin accounts, and apply the VulnCheck advisory guidance at https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-missing-authorization-allows-superadmin-deletion-via-deleteuser-api.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
phpMyFAQ is a PHP-based FAQ and knowledge-base application with a multi-tier administrative model. The deleteUser() handler in the admin API authenticates the caller and checks the delete_user permission but fails to enforce role hierarchy or protect superadmin targets other than the hard-coded userId 1, a CWE-269 improper privilege management flaw. Because the API is network reachable and requires only a low-privilege authenticated session, a non-superadmin permission holder can issue a DELETE request to /admin/api/user/delete with a superadmin's userId greater than 1, deleting that account. The CPE thorsten:phpmyfaq:* covers releases before 4.1.9; the CVSS 4.0 vector PR:L confirms the authenticated prerequisite, with VC:N/VI:H/VA:H reflecting account removal without data disclosure.
Know when Phpmyfaq gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Network API with low complexity but requires an authenticated delete_user account (PR:L); deleting superadmins damages integrity/accountability (I:H) and admin availability (A:H) with no data disclosure (C:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.
Technical POC Analysis
CWE-269 (Improper Privilege Management), overlapping CWE-863 (Incorrect Authorization), in deleteUser() in src/phpMyFAQ/Controller/Administration/Api/UserController.php (phpMyFAQ 4.1.8, commit 33fae2…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
phpMyFAQ versions prior to 4.1.9 contain a missing authorization flaw that lets a non-superadmin administrator holding the delete_user permission remove superadmin accounts other than the protected userId 1, undermining administrative accountability and potentially disrupting knowledge-base operations. Organizations relying on phpMyFAQ for internal or public documentation should treat this as a high-priority integrity and availability risk because it can strip oversight from the administrator pool and complicate incident response. No public exploit was identified at time of analysis, but the flaw still warrants prompt permission cleanup because it can be triggered by an existing administrative role with delete_user.
No vendor-released patch identified at time of analysis; interim mitigations include removing delete_user from all non-superadmin roles, restricting administrative and API access to trusted networks, alerting on superadmin deletions, validating backups, and reviewing admin logs for unauthorized user removals.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Duplicate-email registration handling in phpMyFAQ 4.0.7 through 4.0.13 (and 4.0-nightly-2025-10-03 and earlier) lets una
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
Exploit-DB