Authorization Bypass in phpMyFAQ by phpMyFAQ Team
CVE-2026-111897

7.1HIGH

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111897?

The phpMyFAQ software prior to version 4.2.0-beta contains an authorization bypass vulnerability that enables users with limited permissions to manipulate attachments associated with FAQs outside their designated categories. By supplying arbitrary record IDs, attackers can send upload or delete requests for files on unauthorized FAQs, undermining the integrity of FAQ management and potentially exposing sensitive information.

Affected Version(s)

phpMyFAQ 4.2.0-alpha < 4.2.0-beta

phpMyFAQ 4.2.0-beta

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

bp0lr
.