CVE-2026-111900

The software phpMyFAQ versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta is vulnerable to an improper authorization flaw in attachment.php. The application fails to verify if an attachment's parent FAQ is published or visible to the requester. Consequently, authenticated users possessing the...

EUVD-2026-103320

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request...

CVE-2026-111900 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request...

CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...

CVE-2026-111898

phpMyFAQ versions 4.2.0-alpha before 4.2.0-beta are vulnerable to an authentication bypass due to implicit account linking with Keycloak . An attacker controlling a Keycloak identity with a colliding preferred_username or an unverified email can exploit this flaw by logging in through the /auth/k...

EUVD-2026-103321

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...

CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...

CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...

CVE-2026-111897 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a...

EUVD-2026-103322

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a...

CVE-2026-111897 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a...

CVE-2026-111896 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass

phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them,...

EUVD-2026-103323

phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them,...

CVE-2026-111897

The software phpMyFAQ versions 4.2.0-alpha before 4.2.0-beta is vulnerable to an authorization bypass in the attachment administration endpoints. The root cause is a failure to properly restrict actions based on user categories, allowing editors with medium permission mode to manage attachments f...

CVE-2026-111896

phpMyFAQ versions 4.2.0-alpha before 4.2.0-beta are vulnerable to a stored cross-site scripting (XSS) flaw within the SvgSanitizer component. The vulnerability exists because the sanitizer's single-pass removal process can be bypassed by splitting script tags around removed tokens, such as proces...

CVE-2026-111896 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass

phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them,...

CVE-2026-111895 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

EUVD-2026-103324

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

CVE-2026-111895

The phpMyFAQ application (versions 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta ) contains an authentication bypass in the Microsoft Entra ID login flow. The root cause is located in the AuthEntraId::create() function, which improperly links users using the mutable preferred_username claim and ...

CVE-2026-111895 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...