CVE-2026-111902

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.2.0-alpha through 4.2.0-beta

Description An authorization bypass exists in the isFaqAccessibleForUser() function, which incorrectly treats missing FAQ translations as visible to unauthenticated users. By sending a mismatched Accept-Language header to the comments and attachments API endpoints, attackers can read comments and attachment listings of unpublished or ACL-restricted FAQs. Access Control List (ACL) is a mechanism used to define which users or system processes are granted access to objects on a network.

Recommendations Update phpMyFAQ to version 4.2.0-beta or later.