What is GHSA-6hrq-q673-6545?

GHSA-6hrq-q673-6545 is a security advisory published by GitHub Security Advisories with High severity. phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated...

Which CVE IDs does GHSA-6hrq-q673-6545 cover?

GHSA-6hrq-q673-6545 covers the following CVE IDs: CVE-2026-124433. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6hrq-q673-6545?

GHSA-6hrq-q673-6545 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-6hrq-q673-6545HighCVSS 6.5

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-124433 →

📋 Description

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.

🔗 References (4)

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jprf-xpcq-vjwq
https://nvd.nist.gov/vuln/detail/CVE-2026-124433
https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.11-insufficient-authorization-in-group-deletion-via-groupcontroller
https://github.com/advisories/GHSA-6hrq-q673-6545