Live › vulnerability › CVE-2026-111900
Go to dashboardphpMyFAQ before 4.1.9 and 4.2.0-beta does not check whether an attachment's parent FAQ is published before serving the file. A logged-in user with the dlattachment permission can fetch attachments belonging to unpublished draft FAQs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running phpMyFAQ below 4.1.9 or on a 4.2 alpha build, where attachments are used and some logged-in users have the dlattachment permission. Sites with no attachments, or where only trusted administrators can log in, carry little practical risk. Anonymous visitors cannot trigger this.
No product ranges from the sources yet.
index.php version or the admin dashboard; versions below 4.1.9, or 4.2.0-alpha builds before 4.2.0-beta, are exposed.4.1.9 or later on the 4.1 line, or to 4.2.0-beta or later on the 4.2 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id=<ID> to download complete attachment files belonging to draft FAQs.
This page as .md · .json · in your agent: get_signal("CVE-2026-111900")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.