CVE-2026-111910 in phpMyFAQ
Summary
by MITRE • 10/17/2026
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in phpMyFAQ versions prior to 4.1.9 and version 4.2.0-alpha before 4.2.0-beta represents a critical authorization bypass flaw within the application's file handling mechanism, specifically located in the attachment.php script. This security defect stems from an insufficient implementation of access control checks when processing requests for document attachments associated with frequently asked questions (FAQs). In a properly secured content management system like phpMyFAQ, every resource request must be validated against the user's current session permissions and the specific access rights assigned to the individual record being accessed. However, in this vulnerable configuration, the application fails to enforce per-record permission checks during the attachment retrieval process. This architectural oversight allows an attacker to bypass the intended security boundaries that restrict access to sensitive information within private or restricted FAQ entries.
From a technical perspective, the flaw exploits the decoupling of identity verification from resource authorization. When a user requests an attachment by providing its unique identifier, the backend logic retrieves and serves the file without adequately verifying whether the requesting entity has explicit permission to view the parent FAQ record containing that attachment. This creates a situation where the application trusts the validity of the request based on superficial checks rather than deep validation against the database's access control lists. Consequently, individuals who possess only low-level privileges, such as the dlattachment right which typically permits downloading public attachments, can exploit this gap to access files linked to restricted content. Furthermore, if the system configuration allows downloads for guests by setting allowDownloadsForGuests to true, anonymous users without any authenticated identity can also leverage this vulnerability to retrieve confidential documents that should remain inaccessible to unauthenticated visitors.
The operational impact of this authorization bypass is significant, as it directly compromises the confidentiality and integrity of sensitive organizational data stored within the FAQ system. Attackers with low privileges or those operating anonymously can exfiltrate proprietary information, internal policies, customer support details, or other restricted materials that were intended for a limited audience. This type of vulnerability aligns closely with CWE-284, which describes Improper Access Control, and specifically relates to CWE-862 regarding Missing Authorization checks in the context of specific resources. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques involving unauthorized access to restricted data or exploitation of misconfigured permissions within web applications. The ability for anonymous users to download files further exacerbates the risk by removing the need for credential theft or social engineering prerequisites, thereby lowering the barrier to entry for malicious actors seeking to harvest sensitive information from the target environment.
To mitigate this vulnerability and restore secure access controls, it is imperative that system administrators upgrade phpMyFAQ immediately to version 4.1.9 or later, where these authorization checks have been corrected in the attachment.php module. For environments running older versions that cannot be upgraded instantly, a temporary mitigation involves disabling guest downloads by setting allowDownloadsForGuests to false within the configuration settings. This restricts file retrieval operations exclusively to authenticated users with verified identities and appropriate permissions. Additionally, security teams should conduct an audit of existing FAQ records to ensure that sensitive content is not stored in locations accessible via public-facing interfaces without robust encryption or additional access layers. Regular penetration testing focused on authorization bypasses and continuous monitoring for anomalous download patterns can also help detect potential exploitation attempts while the system remains under maintenance or transition periods.