Description
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| thorsten | phpMyFAQ | 4.2.0-alpha – < 4.2.0-beta | 4.2.0-beta |
References
- GitHub Security Advisory (GHSA-crh2-cv2j-cpjh) vendor-advisory
- VulnCheck Advisory: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API third-party-advisory