Authorization Bypass in phpMyFAQ by Thorsten

CVE-2026-111910

What is CVE-2026-111910?

The phpMyFAQ application, prior to version 4.1.9 and 4.2.0-alpha before 4.2.0-beta, is susceptible to an authorization bypass vulnerability in its attachment handling component. This flaw enables low-privileged users, who possess the 'dlattachment' right, or even anonymous users when the 'allowDownloadsForGuests' setting is active, to bypass critical permission checks. Consequently, an attacker could exploit this vulnerability to download confidential attachments linked to restricted FAQs, potentially exposing sensitive information without proper authorization.

References