CVE-2026-111902
Deferred Deferred - Pending Action

Authorization Bypass in phpMyFAQ 4.2.0-beta via Accept-Language Header

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111902
EUVD
EUVD-2026-103318

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thorsten phpMyFAQ 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in phpMyFAQ versions 4.2.0-alpha up to 4.2.0-beta. The flaw exists in the isFaqAccessibleForUser() function, which incorrectly treats missing FAQ translations as accessible to unauthenticated users. Attackers can exploit this by sending a mismatched Accept-Language header to the comments and attachments API endpoints to read restricted or unpublished FAQ content.

Detection Guidance

To detect this vulnerability, monitor API requests to phpMyFAQ endpoints like /comments and /attachments. Look for requests with mismatched Accept-Language headers that return data from unpublished or restricted FAQs. Check server logs for unusual access patterns or unauthorized data exposure in these endpoints.

Impact Analysis

Unauthenticated attackers can access sensitive data such as usernames, comment bodies, timestamps, and attachment listings for FAQs that should be restricted or unpublished. This includes draft content and ACL-protected FAQs, potentially exposing confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of personal or protected health information through leaked comments or attachments may result in compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade phpMyFAQ to version 4.2.0-beta or later. If upgrading is not possible, restrict access to the /comments and /attachments API endpoints via firewall rules or web server configuration. Review and audit all FAQ visibility settings to ensure proper access controls are in place.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111902. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart