The vulnerability is an improper authorization flaw located in attachment.php of phpMyFAQ. The code fails to verify that an attachment’s parent FAQ is published or visible to the requester before permitting a download. As a result, an authenticated user who has the dlattachment permission can request attachment files from FAQs that are still in draft or unpublished status. This allows privileged users to access and download full attachment contents that should otherwise remain confidential. Consequently, the primary impact is the disclosure of sensitive information and potential exposure of internal data.

Vulnerable installations are the phpMyFAQ content‑management system distributed by Thorsten, specifically any release prior to 4.1.9 and any 4.2.0‑alpha version prior to 4.2.0‑beta. Users running these versions of phpMyFAQ must evaluate whether they are still on a vulnerable version and consider an update.

The CVSS 5.3 score places this vulnerability in the medium risk range, emphasizing that it is significant but not critical. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that there have not been publicly reported exploits yet. Exploitation requires legitimate authentication and the dlattachment permission; an attacker would need to compromise a user account or obtain credentials that grant that permission. Once an authenticated user is available, the download request is simple: index.php?action=attachment&id=<ID>. Because the flaw is in the application logic rather than in the underlying server, network isolation alone does not mitigate the risk.