Privilege Escalation via Unauthorized Superadmin Account Deletion

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

phpMyFAQ versions before 4.1.9 suffer from a critical authorization bypass in the deleteUser() API endpoint. Despite requiring authentication and the delete_user permission, the function fails to validate whether the requesting user has sufficient privileges to delete superadmin accounts. This allows authenticated non-superadmin users to craft DELETE requests targeting superadmin user IDs (excluding ID 1) and permanently remove administrative accounts. Organizations using phpMyFAQ are at risk of losing administrative control, audit accountability, and system governance—particularly if superadmin credentials are the only accounts with full system access.

Casky's 224 mapped security skills leverage Claude's extended reasoning to detect the privilege escalation patterns underlying this vulnerability, correlating with MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners querying Casky would identify detection signals such as: unauthorized API calls to /admin/api/user/delete from non-superadmin accounts, deletions of high-privilege user records by lower-privileged requesters, sudden loss of administrative accounts in audit logs, and HTTP DELETE requests with mismatched privilege contexts. Claude's reasoning engine would flag inconsistencies between the requester's assigned permissions and the sensitivity of the target resource, enabling teams to spot both active exploitation attempts and post-compromise account removal tactics used to cover an attacker's tracks.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-111909.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-111909

Casky has 224 skills that investigate the attack patterns behind CVE-2026-111909. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn