Live › vulnerability › CVE-2026-111910
Go to dashboardphpMyFAQ before 4.1.9 and 4.2.0-beta lets users download attachments from FAQs they should not see, because attachment.php skips per-record permission checks. An attacker with the dlattachment right, or a guest when guest downloads are enabled, can request attachment IDs and read confidential files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running phpMyFAQ with restricted FAQs that carry attachments are exposed. The risk is highest when guest downloads are enabled, since no account is needed. Sites with no restricted FAQs or no attachments have little to lose, but should still upgrade.
No product ranges from the sources yet.
phpMyFAQ admin panel or the version value in the installed files; flag anything below 4.1.9 or in the 4.2.0-alpha line before 4.2.0-beta.allowDownloadsForGuests is enabled in the configuration.4.1.9 or later on the 4.1 line, or to 4.2.0-beta or later on the 4.2 line.allowDownloadsForGuests to disabled and review who holds the dlattachment right.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.
This page as .md · .json · in your agent: get_signal("CVE-2026-111910")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.