---
id: "CVE-2026-111897"
kind: "vulnerability"
aliases: ["CVE-2026-111897"]
title: "phpMyFAQ: category-restricted editors can change attachments on other FAQs"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "phpmyfaq", "self-hosted"]
not_affected_if: ["default-config", "no-category-restricted-editors"]
published_at: "2026-10-17T19:16:31+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:36:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111897", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# phpMyFAQ: category-restricted editors can change attachments on other FAQs

phpMyFAQ 4.2.0-alpha before 4.2.0-beta lets a category-restricted editor upload or delete attachments on FAQs outside their assigned categories by supplying arbitrary record IDs. An attacker with that editor role can tamper with or remove files on FAQs they should not be able to touch.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed phpMyFAQ version, for example with `grep -i version phpmyfaq/inc/Constants.php` or the admin dashboard, and see whether it is in the 4.2.0-alpha to before 4.2.0-beta range.
- Check whether medium permission mode is in use (unknown from the sources how it is set).

## Fix

- Upgrade phpMyFAQ to `4.2.0-beta` or later.
- Until upgraded, restrict editor accounts to trusted users (unknown whether the sources name a workaround).

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111897

## From the sources

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_