phpMyFAQ before version 4.1.8 has an access control flaw in its admin content pages that allows users with lower privileges to read draft and inactive content. The flaw is caused by incorrect permission checks enforced on admin interfaces, enabling editors who only have add permissions to view unpublished news and FAQ translations that should remain hidden from the public. This results in unauthorized disclosure of content that may contain sensitive planning or internal data.

The vulnerability affects installations of phpMyFAQ software released prior to version 4.1.8. All deployments using those earlier releases are susceptible, regardless of the hosting environment or operating system.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting a lower likelihood of widespread exploitation. The most likely attack vector is a web-based attack that exploits the authenticated admin interface, where an attacker who has been granted add-level permissions can navigate to protected endpoints such as the news edit and FAQ translate pages to view unpublished content. The vulnerability requires valid authentication but insufficiently verifies the user's privilege level, making it easier for an insider or compromised editor account to abuse the flaw.