Summary
phpMyFAQ contains a missing authorization check in the user-deletion API, allowing certain authenticated users with delete_user permission to delete superadmin accounts. This may remove administrative access and weaken accountability when the targeted account is a superadmin whose identifier is accepted by the API.
phpMyFAQ contains a missing authorization check in the user-deletion API, allowing certain authenticated users with delete_user permission to delete superadmin accounts. This may remove administrative access and weaken accountability when the targeted account is a superadmin whose identifier is accepted by the API.
Affected context
The issue occurs in phpMyFAQ deployments where authenticated users are granted the delete_user permission and the user-deletion API does not separately verify that the target account is protected or that the requester has sufficient administrative authority. The risk depends on the account hierarchy, permission assignments, and whether the affected API is reachable.
The issue occurs in phpMyFAQ deployments where authenticated users are granted the delete_user permission and the user-deletion API does not separately verify that the target account is protected or that the requester has sufficient administrative authority. The risk depends on the account hierarchy, permission assignments, and whether the affected API is reachable.
Exploit preconditions
- Attack surface: The authenticated administrative user-management API - Required access: An authenticated account with delete_user permission - Trigger point: A user-deletion request targeting a superadmin account - Authorization condition: The API checks the general deletion permission but
does not adequately enforce protection for superadmin targets
- Resulting exposure: A permitted non-superadmin user may delete a more
privileged account
- Attack surface: The authenticated administrative user-management API - Required access: An authenticated account with delete_user permission - Trigger point: A user-deletion request targeting a superadmin account - Authorization condition: The API checks the general deletion permission but
does not adequately enforce protection for superadmin targets
- Resulting exposure: A permitted non-superadmin user may delete a more
privileged account
Why this happens
The vulnerability is caused by an incomplete authorization decision in the deleteUser() operation. The endpoint appears to rely on a broad permission check without enforcing the additional privilege boundary associated with superadmin accounts. This maps to CWE-269, Improper Privilege Management, because a lower-privileged authenticated user can perform an action affecting a higher-privileged account.
The vulnerability is caused by an incomplete authorization decision in the deleteUser() operation. The endpoint appears to rely on a broad permission check without enforcing the additional privilege boundary associated with superadmin accounts. This maps to CWE-269, Improper Privilege Management, because a lower-privileged authenticated user can perform an action affecting a higher-privileged account.
Potential impact
- Administrative access may be removed
- Superadmin accounts may be deleted without appropriate authorization
- Incident investigation and accountability may be weakened
- Organizations could experience administrative denial of service
- Attackers may be able to disrupt user and permission management
- Administrative access may be removed
- Superadmin accounts may be deleted without appropriate authorization
- Incident investigation and accountability may be weakened
- Organizations could experience administrative denial of service
- Attackers may be able to disrupt user and permission management
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the point of every sensitive state-changing operation. Secure-by-default patterns include treating superadmin accounts as protected resources, requiring an explicit higher-privilege authorization decision for privileged-account changes, and denying deletion when the requester lacks equivalent authority. Permission checks should be based on the authenticated principal rather than user-supplied target attributes, while account-management actions should use least privilege, strong audit logging, and safe administrative workflows.
Mitigation generally focuses on enforcing authorization at the point of every sensitive state-changing operation. Secure-by-default patterns include treating superadmin accounts as protected resources, requiring an explicit higher-privilege authorization decision for privileged-account changes, and denying deletion when the requester lacks equivalent authority. Permission checks should be based on the authenticated principal rather than user-supplied target attributes, while account-management actions should use least privilege, strong audit logging, and safe administrative workflows.
How teams detect issues like this
Detection approaches include static analysis and code review for deletion handlers that check only a generic permission without comparing requester and target privilege levels. Reviewers can inspect all user-management routes for consistent object-level authorization, protected-account handling, and denial-by-default behavior. Runtime monitoring and policy enforcement can alert on deletion requests involving privileged accounts, especially when initiated by non-superadmin identities or outside approved administrative workflows. Automated security review tools may help identify missing authorization patterns.
Detection approaches include static analysis and code review for deletion handlers that check only a generic permission without comparing requester and target privilege levels. Reviewers can inspect all user-management routes for consistent object-level authorization, protected-account handling, and denial-by-default behavior. Runtime monitoring and policy enforcement can alert on deletion requests involving privileged accounts, especially when initiated by non-superadmin identities or outside approved administrative workflows. Automated security review tools may help identify missing authorization patterns.
