CVE-2026-111902: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running phpMyFAQ 4.2.0-alpha before 4.2.0-beta are affected. The issue can expose comments and attachment listings associated with unpublished or ACL-restricted FAQs.
What does an attacker need to exploit this?
An attacker can exploit the issue remotely without authentication or user interaction. They need to send a mismatched Accept-Language header when requesting the comments or attachments API endpoints.
What information can be accessed through the bypass?
The bypass allows reading comments and attachment listings for FAQs that should be unpublished or restricted by ACLs. The provided data does not indicate that attachment file contents themselves can be downloaded through this issue.
What can be done if upgrading is not immediately possible?
The provided data identifies the comments and attachments API endpoints and mismatched Accept-Language headers as the exploit path. Restricting unauthenticated access to those endpoints can reduce exposure until an update to 4.2.0-beta or later is applied.