Vulnerability · Published Oct 17, 2026 · Assigned by VulnCheck

CVE-2026-111910phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads

Medium 6.5

In plain English

A medium-severity missing authorization in phpMyFAQ from thorsten. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 79.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.

Affected products (as reported)

Vendor	Product	Versions
thorsten	phpMyFAQ	0 – before 4.1.9
thorsten	phpMyFAQ	4.2.0-alpha – before 4.2.0-beta

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-pp67-9fv9-ph7q) vendor-advisory
VulnCheck Advisory: phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads third-party-advisory