https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T20:55:39.489549+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-111885 CVE-2026-111885 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API 2026-10-20T20:55:39.490689+00:00

Affected: thorsten phpMyFAQ

phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.