The vulnerability in phpMyFAQ 4.2.0-alpha allows editors with category restrictions to manipulate attachments of FAQs outside their assigned categories by supplying arbitrary record IDs. This bypasses the intended access controls and permits upload or deletion of attachments, thereby compromising the integrity of FAQ content and potentially disrupting availability if attachments are removed. The weakness is categorized as CWE-862, an authorization oversight that results in privilege escalation.

Affected vendors include Thorsten for the phpMyFAQ product. Any installation of phpMyFAQ version 4.2.0-alpha and earlier, up to but not including 4.2.0-beta, is vulnerable. The exact version range is 4.2.0-alpha releases, but all prior alpha releases are also at risk.

The CVSS score of 7.1 indicates a moderate to high severity. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers with medium‑level permissions can exploit the flaw through web‑based attachment administration endpoints by submitting malicious upload or delete requests with crafted record_id or attachment ID values. The attack vector is inferred to be remote via the web interface, relying on valid credentials of an editor role that can alter attachments.