Live › vulnerability › CVE-2026-111897
Go to dashboardphpMyFAQ 4.2.0-alpha before 4.2.0-beta lets a category-restricted editor upload or delete attachments on FAQs outside their assigned categories by supplying arbitrary record IDs. An attacker with that editor role can tamper with or remove files on FAQs they should not be able to touch.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations on phpMyFAQ 4.2.0-alpha before 4.2.0-beta that use category-restricted editor accounts under medium permission mode are exposed. Installations that do not use category-restricted editors, or that run a version outside the affected range, can skip it.
No product ranges from the sources yet.
grep -i version phpmyfaq/inc/Constants.php or the admin dashboard, and see whether it is in the 4.2.0-alpha to before 4.2.0-beta range.4.2.0-beta or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.
This page as .md · .json · in your agent: get_signal("CVE-2026-111897")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.