Medium severity4.3NVD Advisory· Published Oct 17, 2026· Updated Oct 17, 2026

CVE-2026-111900

Description

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id= to download complete attachment files belonging to draft FAQs.

Affected products

PhpMyAdmin/Phpmyfaqllm-create
Range: <4.1.9, <4.2.0-beta

Patches

Vulnerability mechanics

References

github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h76j-35m7-3mwqnvd
www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-draft-faq-attachment-disclosure-via-attachment-phpnvd

News mentions

PhpMyFAQ: 25 Vulnerabilities Including Critical Auth Bypass Disclosed Together
Vypr Intelligence · Oct 17, 2026

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000