Live › vulnerability › CVE-2026-111902
Go to dashboardIn phpMyFAQ 4.2.0-alpha before 4.2.0-beta, the access check treats an FAQ with no translation for the requested language as visible to everyone. An unauthenticated attacker can send a mismatched Accept-Language header to the comments and attachments API and read comments and attachment lists of unpublished or access-restricted FAQs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running phpMyFAQ 4.2.0-alpha, where FAQs are unpublished or restricted by access control lists and some of them lack a translation for the language requested. Sites on 4.2.0-beta or later are not affected by this flaw. The sources do not say whether a default configuration is needed for the bypass to work.
No product ranges from the sources yet.
4.2.0-alpha up to but not including 4.2.0-beta is affected.4.2.0-beta or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs.
This page as .md · .json · in your agent: get_signal("CVE-2026-111902")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.