High priorityDisclosed

Advisory · CVE-2026-111909

phpMyFAQ deleteUser API allows non-superadmins to delete superadmin accounts

phpMyFAQ before 4.1.9 has a missing authorization flaw in the deleteUser API that lets authenticated non-superadmin users holding delete_user permission delete superadmin accounts, removing administrative access and accountability. CVSS 3.1 8.1.

Advisory published October 17, 2026Independent summary
Vendor
phpMyFAQ
Product
phpMyFAQ
Identifier / CWE
CVE-2026-111909
CWE-269
Action timing
Immediate
ELI5

Explain it like I’m five

A staffer trusted to tidy up ordinary accounts can also delete the bosses, because the delete button never asks how senior the target is.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Privileged staffer signs in

    An authenticated non-superadmin user with delete_user permission targets the admin user delete API.

  2. 02Superadmin targeted

    The attacker sends a DELETE request naming a superadmin user ID other than 1.

  3. 03Admin removed

    The superadmin account is deleted, removing administrative access and accountability for that identity.

What happened

The phpMyFAQ project disclosed CVE-2026-111909: a missing authorization flaw (CWE-269) in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts via DELETE /admin/api/user/delete. It affects versions before 4.1.9.

Per the vendor affected data in the NVD record, 4.1.9 is the first unaffected release, so upgrading to 4.1.9 or later is the stated fix.

What to do

  1. Inventory phpMyFAQ instances, including staging, demo, and help-desk installs.
  2. Upgrade affected instances to 4.1.9 or later using the project release guidance.
  3. Restrict administrative and API access to trusted networks while remediation is underway.
  4. Hunt for user deletion events, especially any deletion of administrative accounts, and delete_user permission grants.
  5. Verify the deployed version after updating, not just that an update ran.

Management note

Deleting an admin is both an outage and an evidence problem. Upgrade, then reconcile the current admin roster against HR and IdP records, not against the application itself.