phpmyfaq -- multiple vulnerabilities

phpMyFAQ team reports:

The WebAuthn prepare-login endpoint returns stable credential IDs for existing accounts with registered passkeys and rotating credential IDs for unknown accounts, so an unauthenticated attacker can enumerate user accounts and passkeys.

Insufficient authorization checks allow a delegated group administrator to delete groups with higher privileges than their own.

[source]