{"id":"CVE-2026-111900","kind":"vulnerability","aliases":["CVE-2026-111900"],"related":[],"title":"phpMyFAQ: authenticated users can download attachments from draft FAQs","description":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id=<ID> to download complete attachment files belonging to draft FAQs.","summary":"phpMyFAQ before 4.1.9 and 4.2.0-beta does not check whether an attachment's parent FAQ is published before serving the file. A logged-in user with the dlattachment permission can fetch attachments belonging to unpublished draft FAQs.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["auth-required","no-attachments"],"how_to_check":"- Check the installed version: `index.php` version or the admin dashboard; versions below `4.1.9`, or `4.2.0-alpha` builds before `4.2.0-beta`, are exposed.\n- Confirm whether any users hold the dlattachment permission in the admin user and rights settings.","fix":"- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line, or to `4.2.0-beta` or later on the 4.2 line.","status":"open","published_at":"2026-10-17T19:16:31+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:26:52+00:00","updated_at":"2026-10-25T04:26:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:26:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line, or to `4.2.0-beta` or later on the 4.2 line.","reach":"internet","title":"phpMyFAQ: authenticated users can download attachments from draft FAQs","impact":"low","summary":"phpMyFAQ before 4.1.9 and 4.2.0-beta does not check whether an attachment's parent FAQ is published before serving the file. A logged-in user with the dlattachment permission can fetch attachments belonging to unpublished draft FAQs.","category":"package","nicknames":[],"who_cares":["phpmyfaq","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated users read attachments from unpublished draft FAQs","analyst_note":"","how_to_check":"- Check the installed version: `index.php` version or the admin dashboard; versions below `4.1.9`, or `4.2.0-alpha` builds before `4.2.0-beta`, are exposed.\n- Confirm whether any users hold the dlattachment permission in the admin user and rights settings.","needs_analyst":false,"not_affected_if":["auth-required","no-attachments"],"who_is_affected":"Sites running phpMyFAQ below 4.1.9 or on a 4.2 alpha build, where attachments are used and some logged-in users have the dlattachment permission. Sites with no attachments, or where only trusted administrators can log in, carry little practical risk. Anonymous visitors cannot trigger this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3369,"output_tokens":574,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111900':12A,15A '-2026':11A,14A '4.1.9':24B,62C '4.2.0':26B,64C,67C 'action':102C 'alpha':65C 'attach':6A,33B,54B,82C,103C,108C 'attachment.php':75C 'authent':2A,93C 'author':72C 'belong':55B,110C 'beta':27B,68C 'check':30B 'complet':107C 'contain':69C 'cve':10A,13A 'dlattach':50B,97C 'download':5A,106C 'draft':8A,58B,112C 'fail':77C 'faq':9A,36B,59B,85C,113C 'fetch':53B 'file':42B,109C 'host':21B 'id':104C 'improp':71C 'index.php':101C 'log':45B 'logged-in':44B 'packag':16B 'parent':35B,84C 'permiss':51B,98C 'php':17B 'phpmyfaq':1A,18B,22B,60C 'publish':38B,87C 'request':92C,100C 'self':20B 'self-host':19B 'serv':40B 'unpublish':57B 'user':3A,47B,94C 'verifi':79C 'visibl':89C 'vulner':73C 'whether':31B,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running phpMyFAQ below 4.1.9 or on a 4.2 alpha build, where attachments are used and some logged-in users have the dlattachment permission. Sites with no attachments, or where only trusted administrators can log in, carry little practical risk. Anonymous visitors cannot trigger this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111900","severity":null,"published_at":"2026-10-17T19:16:31+00:00","modified_at":"2026-10-21T22:16:47+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}