CVE-2026-111900
Deferred Deferred - Pending Action

Improper Authorization in phpMyFAQ Leading to Unauthorized Attachment Access

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id=<ID> to download complete attachment files belonging to draft FAQs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111900
EUVD
EUVD-2026-103320

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thorsten phpMyFAQ 0
thorsten phpMyFAQ 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper authorization issue in phpMyFAQ versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta. It allows authenticated users with the dlattachment permission to download attachment files from draft FAQs by directly accessing a URL, even though the parent FAQ is unpublished or hidden. The system fails to verify if the FAQ containing the attachment is published or visible to the requester.

Detection Guidance

Check phpMyFAQ versions before 4.1.9 or 4.2.0-beta for the vulnerability. Test by attempting to access index.php?action=attachment&id=<ID> for draft FAQ attachments using an authenticated user with dlattachment permission. Monitor for unauthorized attachment downloads from unpublished content.

Impact Analysis

This vulnerability allows low-privileged users to bypass publication boundaries and access confidential draft attachments. Even if a user cannot view a draft FAQ through normal means, they can still download its attachments via a direct URL. This could lead to unauthorized access to sensitive or unpublished content.

Compliance Impact

This vulnerability could lead to unauthorized access to draft or unpublished FAQ attachments, potentially exposing sensitive or confidential data. For GDPR, this may violate principles of data protection and user rights if personal data is involved. For HIPAA, it could risk unauthorized disclosure of protected health information if such data is stored in attachments.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.9 or later immediately. Review user permissions to ensure only necessary users have dlattachment permission. Audit logs for suspicious attachment download attempts from draft FAQs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111900. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart