Incorrect authorization in phpMyFAQ - #VU164486
Published: November 10, 2026
Vulnerability identifier: #VU164486
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose files attached to access-restricted FAQs.
The vulnerability exists due to incorrect authorization in phpMyFAQ's attachment download handler when evaluating record permissions, mishandling the all-users sentinel, bypassing group checks in basic mode, and allowing the guest-download flag to override record ACLs. A remote attacker can request restricted attachments anonymously when guest downloads are enabled, or through an account with download rights in basic mode, to retrieve files without permission to view their associated FAQs.
Affected software
phpMyFAQ
Remediation
Install security update from vendor's website.
phpMyFAQ - update to 4.1.9