CVE-2026-111900 in phpMyFAQ
Summary
by MITRE • 10/17/2026
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id=<ID> to download complete attachment files belonging to draft FAQs.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The identified security flaw resides within phpMyFAQ versions prior to 4.1.9 and version 4.2.0-alpha before 4.2.0-beta, specifically affecting the attachment.php component of the application. This vulnerability is classified as an improper authorization issue where the system fails to adequately verify access control policies for specific resources. In a properly secured content management environment, draft or unpublished items are intended to remain invisible and inaccessible to all users except those with explicit administrative privileges who have saved them in a non-public state. However, due to this logic error, the application does not check whether the parent FAQ item associated with an attachment is published or visible to the requesting user before granting access to the file itself.
The technical mechanism of exploitation involves authenticated users possessing the dlattachment permission utilizing a crafted HTTP request directed at index.php?action=attachment&id=<ID>. By manipulating the ID parameter, these authorized but non-administrative users can bypass visibility restrictions and download complete attachment files that belong to draft FAQs. This behavior indicates a failure in server-side validation logic where the authorization check is decoupled from the publication status of the parent content object. Consequently, sensitive documents, images, or other data attached to drafts intended for internal review only are exposed to any user with basic download permissions, leading to an unauthorized disclosure of confidential information.
From an operational impact perspective, this vulnerability allows for the exfiltration of potentially sensitive organizational data that was never meant to be public. Since draft FAQs often contain preliminary answers, proprietary strategies, or unverified technical support solutions, their exposure can lead to intellectual property theft, competitive disadvantage, or reputational damage if incorrect information is leaked prematurely. The attack vector requires authentication and a specific permission level, which limits the scope of potential attackers but does not eliminate the risk for internal threats or compromised accounts with standard user privileges.
This vulnerability aligns with CWE-269, Improper Privilege Management, as it involves an actor obtaining capabilities beyond their intended permissions by exploiting flawed access control logic. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, specifically within the context of lateral movement or data exfiltration using legitimate credentials that have been granted insufficiently restricted privileges. The core issue is not a lack of authentication but rather an inadequate authorization check during resource retrieval operations.
To mitigate this vulnerability, administrators must upgrade phpMyFAQ to version 4.1.9 or later for the stable branch, or version 4.2.0-beta and above for the development branch, where these access control checks have been corrected. In addition to upgrading, it is advisable to review user permissions and ensure that the dlattachment permission is granted only to users who require unrestricted access to all content types, including drafts if such exposure is acceptable within their security model. Implementing strict server-side validation for publication status before serving any attached files will prevent similar issues in other modules of the application.