CVE-2026-85587: phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages
phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public.
Affected Software
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
Lesser-privileged editor accounts with only add permissions can exploit it. They can use the news edit and FAQ translate administrative endpoints to read content beyond their intended authorization.
What information could be exposed?
The issue exposes draft and inactive content that is not visible to the public, including unpublished news and FAQ content accessible through the affected endpoints.
Which versions are affected?
phpMyFAQ versions before 4.1.8 are affected. Upgrading to 4.1.8 or later removes the described affected version range.