---
id: CVE-2026-111900
title: >-
  phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment
  Disclosure via attachment.php
summary: >-
  phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper
  authorization vulnerability in attachment.php that fails to verify whether an
  attachment's parent FAQ is published or visible to the requester.
  Authenticated us…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: thorsten
product: phpMyFAQ
affected:
  - phpMyFAQ < 4.1.9
  - phpMyFAQ >= 4.2.0-alpha < 4.2.0-beta
published: '2026-10-17'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T18:46:21.382Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111900'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h76j-35m7-3mwq
    label: GitHub Security Advisory (GHSA-h76j-35m7-3mwq)
  - url: >-
      https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-draft-faq-attachment-disclosure-via-attachment-php
    label: >-
      VulnCheck Advisory: phpMyFAQ before 4.1.9 and 4.2.0-alpha before
      4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php
tags:
  - cve.org
ingestedAt: '2026-10-17T19:08:56.922Z'
---

## Overview

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id=<ID> to download complete attachment files belonging to draft FAQs.

## Affected

- `phpMyFAQ < 4.1.9`
- `phpMyFAQ >= 4.2.0-alpha < 4.2.0-beta`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.