CVE-2026-111885
HIGH
7,0
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
5,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: high
Description
AI Translation Available
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0027
Percentile
0,2th
Updated
EPSS Score Trend (Last 3 Days)
1220
Insufficient Granularity of Access Control
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Access Control
Potential Impacts:
Modify Memory
Read Memory
Execute Unauthorized Code Or Commands
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Other
Applicable Platforms
All platforms may be affected
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh
https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-mis…