{"id":"CVE-2026-111910","kind":"vulnerability","aliases":["CVE-2026-111910"],"related":[],"title":"phpMyFAQ: attachment download skips permission checks on restricted FAQs","description":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.","summary":"phpMyFAQ before 4.1.9 and 4.2.0-beta lets users download attachments from FAQs they should not see, because attachment.php skips per-record permission checks. An attacker with the dlattachment right, or a guest when guest downloads are enabled, can request attachment IDs and read confidential files.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["guest-downloads-off-and-no-dlattachment-users","no-attachments","no-restricted-faqs"],"how_to_check":"- Check the installed version with `phpMyFAQ` admin panel or the `version` value in the installed files; flag anything below `4.1.9` or in the `4.2.0-alpha` line before `4.2.0-beta`.\n- Look for restricted FAQs that have attachments, and check whether `allowDownloadsForGuests` is enabled in the configuration.","fix":"- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line, or to `4.2.0-beta` or later on the 4.2 line.\n- Until upgraded, set `allowDownloadsForGuests` to disabled and review who holds the dlattachment right.","status":"open","published_at":"2026-10-17T19:16:33+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:36:19+00:00","updated_at":"2026-10-25T03:36:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:36:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line, or to `4.2.0-beta` or later on the 4.2 line.\n- Until upgraded, set `allowDownloadsForGuests` to disabled and review who holds the dlattachment right.","reach":"internet","title":"phpMyFAQ: attachment download skips permission checks on restricted FAQs","impact":"medium","summary":"phpMyFAQ before 4.1.9 and 4.2.0-beta lets users download attachments from FAQs they should not see, because attachment.php skips per-record permission checks. An attacker with the dlattachment right, or a guest when guest downloads are enabled, can request attachment IDs and read confidential files.","category":"package","nicknames":[],"who_cares":["phpmyfaq","self-hosted","php"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Confidential attachments from restricted FAQs are readable by low-privileged or anonymous users","analyst_note":"Check the NVD entry and the phpMyFAQ 4.1.9 and 4.2.0-beta release notes to confirm the fixed versions and the exact check for version strings.","how_to_check":"- Check the installed version with `phpMyFAQ` admin panel or the `version` value in the installed files; flag anything below `4.1.9` or in the `4.2.0-alpha` line before `4.2.0-beta`.\n- Look for restricted FAQs that have attachments, and check whether `allowDownloadsForGuests` is enabled in the configuration.","needs_analyst":true,"not_affected_if":["no-restricted-faqs","no-attachments","guest-downloads-off-and-no-dlattachment-users"],"who_is_affected":"Sites running phpMyFAQ with restricted FAQs that carry attachments are exposed. The risk is highest when guest downloads are enabled, since no account is needed. Sites with no restricted FAQs or no attachments have little to lose, but should still upgrade.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":3386,"output_tokens":731,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111910':12A,15A '-2026':11A,14A '4.1.9':24B,70C '4.2.0':26B,72C,75C 'allow':85C 'allowdownloadsforguest':112C 'alpha':73C 'anonym':109C 'attach':2A,31B,62B,89C,117C 'attachment.php':39B,83C 'attack':47B,86C 'author':79C 'beta':27B,76C 'bypass':80C,94C 'check':6A,45B,99C 'confidenti':66B,121C 'contain':77C 'cve':10A,13A 'dlattach':50B,106C 'download':3A,30B,57B,88C 'enabl':59B,114C 'faq':9A,33B,92C,125C 'file':67B,122C 'guest':54B,56B 'host':21B 'id':63B,118C 'let':28B 'low':101C 'low-privileg':100C 'packag':16B 'per':42B,96C 'per-record':41B,95C 'permiss':5A,44B,98C 'php':17B 'phpmyfaq':1A,18B,22B,68C 'privileg':102C 'read':65B 'record':43B,97C 'request':61B,116C 'restrict':8A,91C,124C 'retriev':120C 'right':51B,107C 'see':37B 'self':20B 'self-host':19B 'skip':4A,40B 'user':29B,103C,110C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Sites running phpMyFAQ with restricted FAQs that carry attachments are exposed. The risk is highest when guest downloads are enabled, since no account is needed. Sites with no restricted FAQs or no attachments have little to lose, but should still upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111910","severity":null,"published_at":"2026-10-17T19:16:33+00:00","modified_at":"2026-10-21T22:16:47+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}