---
id: "CVE-2026-111900"
kind: "vulnerability"
aliases: ["CVE-2026-111900"]
title: "phpMyFAQ: authenticated users can download attachments from draft FAQs"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "phpmyfaq", "self-hosted"]
not_affected_if: ["auth-required", "no-attachments"]
published_at: "2026-10-17T19:16:31+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:26:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111900", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# phpMyFAQ: authenticated users can download attachments from draft FAQs

phpMyFAQ before 4.1.9 and 4.2.0-beta does not check whether an attachment's parent FAQ is published before serving the file. A logged-in user with the dlattachment permission can fetch attachments belonging to unpublished draft FAQs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version: `index.php` version or the admin dashboard; versions below `4.1.9`, or `4.2.0-alpha` builds before `4.2.0-beta`, are exposed.
- Confirm whether any users hold the dlattachment permission in the admin user and rights settings.

## Fix

- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line, or to `4.2.0-beta` or later on the 4.2 line.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111900

## From the sources

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id=<ID> to download complete attachment files belonging to draft FAQs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_