CVE-2026-111909: Improper Privilege Management in thorsten phpMyFAQ
Description
phpMyFAQ versions prior to 4.1.9 have an authorization vulnerability in the deleteUser() API. Authenticated users with delete_user permission but without superadmin privileges can delete superadmin accounts by sending a crafted DELETE request. This flaw allows removal of administrative accounts other than the default superadmin user with ID 1, potentially disrupting administrative control and accountability.
CVSS v4.0
Score 7.2high
Affected software
thorsten
phpMyFAQ
pkg:github/thorsten/phpMyFAQRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111909 describes an improper privilege management vulnerability in phpMyFAQ before version 4.1.9. The deleteUser() API endpoint lacks proper authorization checks, enabling authenticated users who have delete_user permission but are not superadmins to delete superadmin accounts by issuing a DELETE request to /admin/api/user/delete with the targeted superadmin's userId. This vulnerability can lead to loss of administrative access and accountability within the application.
Potential Impact
An attacker with valid credentials and delete_user permission can delete superadmin accounts other than the default user with ID 1. This compromises administrative control, potentially allowing privilege escalation or denial of administrative access, impacting system integrity and management.
Mitigation Recommendations
Upgrade phpMyFAQ to version 4.1.9 or later where this authorization vulnerability is fixed. No other mitigation guidance is provided. Patch status is confirmed by the version boundary indicating the fix in 4.1.9.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-17T12:18:07.314Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad3c6d22cdf04f656520812
Added to database: 10/17/2026, 19:04:50 UTC
Last enriched: 10/17/2026, 19:18:39 UTC
Last updated: 10/17/2026, 22:21:01 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.