CVE-2026-111900

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.9 phpMyFAQ versions 4.2.0-alpha through 4.2.0-beta

Description An improper authorization issue exists in the attachment.php file. The system fails to verify if the parent FAQ of an attachment is published or visible to the requester. Authenticated users possessing the dlattachment permission can use the endpoint index.php?action=attachment&id=<ID> by manipulating the id variable to download attachment files associated with draft FAQs.

Recommendations Update phpMyFAQ to version 4.1.9 or later. Update phpMyFAQ to version 4.2.0-beta or later.