{"id":"CVE-2026-111897","kind":"vulnerability","aliases":["CVE-2026-111897"],"related":[],"title":"phpMyFAQ: category-restricted editors can change attachments on other FAQs","description":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta lets a category-restricted editor upload or delete attachments on FAQs outside their assigned categories by supplying arbitrary record IDs. An attacker with that editor role can tamper with or remove files on FAQs they should not be able to touch.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["default-config","no-category-restricted-editors"],"how_to_check":"- Check the installed phpMyFAQ version, for example with `grep -i version phpmyfaq/inc/Constants.php` or the admin dashboard, and see whether it is in the 4.2.0-alpha to before 4.2.0-beta range.\n- Check whether medium permission mode is in use (unknown from the sources how it is set).","fix":"- Upgrade phpMyFAQ to `4.2.0-beta` or later.\n- Until upgraded, restrict editor accounts to trusted users (unknown whether the sources name a workaround).","status":"open","published_at":"2026-10-17T19:16:31+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:36:22+00:00","updated_at":"2026-10-25T03:36:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:36:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.2.0-beta` or later.\n- Until upgraded, restrict editor accounts to trusted users (unknown whether the sources name a workaround).","reach":"internet","title":"phpMyFAQ: category-restricted editors can change attachments on other FAQs","impact":"medium","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta lets a category-restricted editor upload or delete attachments on FAQs outside their assigned categories by supplying arbitrary record IDs. An attacker with that editor role can tamper with or remove files on FAQs they should not be able to touch.","category":"package","nicknames":[],"who_cares":["phpmyfaq","php","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker removes or replaces attachment files on FAQs outside their categories.","analyst_note":"Confirm the exact affected version range and fixed release against the phpMyFAQ advisory, and whether medium permission mode is the default; the NVD record alone does not state these.","how_to_check":"- Check the installed phpMyFAQ version, for example with `grep -i version phpmyfaq/inc/Constants.php` or the admin dashboard, and see whether it is in the 4.2.0-alpha to before 4.2.0-beta range.\n- Check whether medium permission mode is in use (unknown from the sources how it is set).","needs_analyst":true,"not_affected_if":["default-config","no-category-restricted-editors"],"who_is_affected":"Installations on phpMyFAQ 4.2.0-alpha before 4.2.0-beta that use category-restricted editor accounts under medium permission mode are exposed. Installations that do not use category-restricted editors, or that run a version outside the affected range, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000669,"input_tokens":3359,"output_tokens":667,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111897':14A,17A '-2026':13A,16A '4.2.0':25B,28B,73C,76C 'abl':69B 'allow':84C 'alpha':26B,74C 'arbitrari':48B,99C 'assign':44B 'attach':8A,39B,91C,119C 'attack':52B,102C 'author':80C 'beta':29B,77C 'bypass':81C 'categori':3A,33B,45B,86C,96C 'category-restrict':2A,32B,85C 'chang':7A 'contain':78C 'cve':12A,15A 'delet':38B,111C 'editor':5A,35B,55B,88C 'faq':11A,41B,64B,93C,129C 'file':62B,126C 'host':23B 'id':50B,101C,117C,120C 'let':30B 'manag':90C 'medium':104C 'mode':106C 'outsid':42B,94C 'packag':18B 'permiss':105C 'php':19B 'phpmyfaq':1A,20B,24B,72C 'record':49B,100C,116C 'remov':61B,125C 'request':112C 'restrict':4A,34B,87C 'role':56B 'self':22B 'self-host':21B 'send':108C 'suppli':47B,98C 'tamper':58B,122C 'target':115C 'touch':71B 'unauthor':128C 'upload':36B,109C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Installations on phpMyFAQ 4.2.0-alpha before 4.2.0-beta that use category-restricted editor accounts under medium permission mode are exposed. Installations that do not use category-restricted editors, or that run a version outside the affected range, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111897","severity":null,"published_at":"2026-10-17T19:16:31+00:00","modified_at":"2026-10-19T22:17:04+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}