CVE-2026-111910: phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
Who can exploit this issue?
Any low-privileged phpMyFAQ user who has the dlattachment right can exploit it. Anonymous users can also exploit it if allowDownloadsForGuests is enabled.
What access does an attacker need?
The attacker needs network access to the phpMyFAQ instance and must be able to request attachment IDs. No user interaction is required.
What information can be exposed?
An attacker can download attachments associated with restricted FAQ records, potentially exposing confidential files despite the restrictions on the related FAQs.
Are default guest download settings affected?
Guest exploitation depends on whether allowDownloadsForGuests is enabled. If it is not enabled, the described anonymous-user path does not apply, although low-privileged users with dlattachment rights may still be affected.