CVE-2026-85587
Received Received - Intake

Incorrect Permission Checks in phpMyFAQ Allow Unauthorized Access to Draft Content

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85587
EUVD
EUVD-2026-71010

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

phpMyFAQ before version 4.1.8 has an authorization flaw where users with limited editor privileges can access unpublished draft or inactive content. Attackers with only 'add' permissions can exploit endpoints like news editing and FAQ translation to view content that should remain hidden from the public.

Detection Guidance

Check phpMyFAQ admin endpoints for unauthorized access attempts. Monitor logs for requests to /admin/news/edit/{id} or /admin/faq/translate/{faqId}/{lang} from users without proper permissions. Use tools like curl to test these endpoints with different user roles.

Impact Analysis

This vulnerability allows unauthorized users to view confidential drafts or inactive content, potentially exposing sensitive information to lower-privileged users like junior editors. It compromises data confidentiality by bypassing proper permission checks.

Compliance Impact

This vulnerability could lead to unauthorized access to unpublished or draft content, which may include sensitive personal data. If such data is exposed, it could violate GDPR's principles of data protection and privacy, particularly if the content includes user data or confidential information. For HIPAA, if the system handles protected health information (PHI) and drafts or inactive content contain PHI, unauthorized access could result in breaches of confidentiality requirements.

Mitigation Strategies

Update phpMyFAQ to version 4.1.8 or later to fix the permission checks. Review user permissions and restrict access to admin content pages. Ensure only authorized users can access draft or inactive content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart