phpMyFAQ Vulnerability in Attachment Download Permissions by Thorsten
CVE-2026-24420

6.5MEDIUM

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
24 January 2026

What is CVE-2026-24420?

The phpMyFAQ application, an open-source FAQ management tool, contains a permissions misconfiguration that allows authenticated users lacking proper download permissions to access and download FAQ attachments. This vulnerability arises from insufficient validation of authorization within the attachment functionality. Specifically, the system improperly recognizes a right key as adequate proof of permission, while flawed logic in the user and group permissions checks potentially exposes sensitive data. This critical flaw has been addressed in subsequent updates to enhance security and protect against unauthorized access.

Affected Version(s)

phpMyFAQ < 4.0.17

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.