CVE-2026-111897: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target recordid or attachment ID to tamper with or remove files on unauthorized FAQs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated category-restricted editor operating in medium permission mode can exploit it. The attacker needs the record ID or attachment ID of a FAQ outside the categories they are authorized to manage.
What can an attacker do with the unauthorized attachment endpoints?
They can submit upload or delete requests targeting arbitrary FAQ record IDs or attachment IDs. This can tamper with files attached to unauthorized FAQs or remove those files.
Which releases are affected?
phpMyFAQ 4.2.0-alpha releases before 4.2.0-beta are affected. The provided data does not identify any other affected versions.