phpMyFAQ before version 4.1.9 suffers from a missing authorization flaw in its deleteUser API. When an authenticated user with delete_user permission sends a DELETE request to /admin/api/user/delete, the system fails to verify the target’s role and will remove any superadmin account whose userId is not 1. This flaw enables a non‑superadmin to delete critical administrative accounts, resulting in loss of control over the application, undermining accountability, and potentially impacting the integrity and availability of the FAQ system. The weakness is categorized as CWE‑269 (Missing Authorization).

All installations of phpMyFAQ running any version earlier than 4.1.9 are affected. There is no narrower version range specified, so any ticket indicating a pre‑4.1.9 release should be considered vulnerable.

The CVSS score of 7.2 places this vulnerability in the high‑severity range. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that while the flaw is known, there is no publicly reported exploitation at this time. The attack requires the attacker to be authenticated and to possess delete_user permission. Once authenticated, the attacker can simply craft a DELETE request with a superadmin’s userId other than 1 to delete that account. This process is straightforward and does not require additional privileges or complex conditions, making the exploitability relatively high within an authenticated context.