Description
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.
Published: 2026-10-17
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized disclosure of confidential attachment data
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an access control failure in attachment.php that lets attackers bypass per‑record permission checks and download files attached to restricted FAQs. Attackers with only the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request arbitrary attachment IDs and retrieve confidential data. This represents a direct disclosure of sensitive information through a web‑based download endpoint.

Affected Systems

phpMyFAQ versions before 4.1.9 and before 4.2.0‑alpha (which includes releases prior to 4.2.0‑beta).

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate‑to‑high severity disclosure risk, but the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web request to attachment.php with a crafted attachment ID, requiring no special privileges beyond an existing dlattachment right or the option to download for guests. An attacker can thus extract confidential media without overtly compromising the server or gaining code execution.

Generated by OpenCVE AI on October 17, 2026 at 21:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest phpMyFAQ release (4.1.9 or 4.2.0‑beta or later) to replace the vulnerable attachment.php logic.
  • If an immediate upgrade is not viable, disable the allowDownloadsForGuests setting to prevent anonymous users from uploading or downloading attachments.
  • Review user roles and remove the dlattachment permission from users who do not need it, ensuring that only authorized users can access attachment download requests.

Generated by OpenCVE AI on October 17, 2026 at 21:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.
Title phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads
First Time appeared Phpmyfaq
Phpmyfaq phpmyfaq
Weaknesses CWE-862
CPEs cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*
Vendors & Products Phpmyfaq
Phpmyfaq phpmyfaq
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Phpmyfaq Phpmyfaq
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-17T18:46:28.155Z

Reserved: 2026-10-17T12:18:55.462Z

Link: CVE-2026-111910

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-17T19:16:33.343

Modified: 2026-10-17T19:16:33.457

Link: CVE-2026-111910

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T21:30:06Z

Weaknesses