CVE-2026-111909 | thorsten phpMyFAQ up to 4.1.8 /admin/api/user/delete deleteUser userId improper authorization

October 17, 2026 Yanac

A vulnerability labeled as problematic has been found in thorsten phpMyFAQ up to 4.1.8. Affected by this issue is the function deleteUser of the file /admin/api/user/delete. The manipulation of the argument userId results in improper authorization.

This vulnerability is known as CVE-2026-111909. It is possible to launch the attack remotely. No exploit is available.

The affected component should be upgraded.VulDB Recent EntriesRead More