CVE-2026-111900: phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id=<ID> to download complete attachment files belonging to draft FAQs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the dlattachment permission. They also need the ID of an attachment associated with a draft FAQ.
What information can be exposed?
The issue allows download of complete attachment files belonging to draft FAQs. It does not indicate modification or deletion of FAQ content or attachments.
Which releases are affected?
Affected releases are phpMyFAQ versions before 4.1.9, and 4.2.0-alpha releases before 4.2.0-beta.
How can I check whether a deployment is vulnerable?
Check the installed phpMyFAQ version and identify accounts granted the dlattachment permission. On affected versions, a permitted authenticated account can request index.php?action=attachment&id=<ID> for an attachment tied to a draft FAQ.