Is CVE-2026-111885 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111885?

CVE-2026-111885 has a CVSS v3 severity of MEDIUM (5.5).

Back

CVE-2026-111885

Description

phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.