CVE-2026-111902Medium· 5.3▾ SunlitphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs.
phpMyFAQ >= 4.2.0-alpha < 4.2.0-betaRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111905Medium· 6.0phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data
CVE-2026-111908High· 8.3phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API
CVE-2026-111888Low· 2.7phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API
CVE-2026-111887Medium· 5.3phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint
CVE-2026-111885Medium· 5.5phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API
CVE-2026-111886Medium· 6.5phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint