Vulnerability · Published Jan 24, 2026 · Assigned by GitHub_M

CVE-2026-24420phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

Medium 6.5

In plain English

A medium-severity improper access control in phpMyFAQ from thorsten. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 60.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incomprehensive permissions check. The presence of a right key is improperly validated as proof of authorization in attachment.php. Additionally, the group and user permission logic contains a flawed conditional expression that may allow unauthorized access. This issue has been fixed in version

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	phpmyfaq/phpmyfaq	4.0.17	GHSA-7p9h-m7m8-vhhv
Packagist	thorsten/phpmyfaq	4.0.17	GHSA-7p9h-m7m8-vhhv

Affected products (as reported)

Vendor	Product	Versions
thorsten	phpMyFAQ	< 4.0.17

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7p9h-m7m8-vhhv x_refsource_CONFIRM