Mtekinau

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.9 phpMyFAQ versions 4.2.0-alpha through 4.2.0-beta **Description** An improper authorization issue exists in the `attachment.php` file. The system fails to verify if the parent FAQ of an attachment is published or visible to the requester. Authenticated users possessing the `dlattachment` permission can use the endpoint `index.php?action=attachment&id=<ID>` by manipulating the `id` variable to download attachment files associated with draft FAQs. **Recommendations** Update phpMyFAQ to version 4.1.9 or later. Update phpMyFAQ to version 4.2.0-beta or later.