CVE-2026-111910

The phpMyFAQ application, specifically versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta , contains an authorization bypass vulnerability in the attachment.php component. The root cause is a failure to perform per-record permission checks, allowing attackers to bypass restrictions and downl...

CVE-2026-111900

The software phpMyFAQ versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta is vulnerable to an improper authorization flaw in attachment.php. The application fails to verify if an attachment's parent FAQ is published or visible to the requester. Consequently, authenticated users possessing the...

CVE-2026-24420

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incomprehensive permissions check. The presence of a right key is improperly validated as proof of authorization in...

CVE-2026-24420 phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incomprehensive permissions check. The presence of a right key is improperly validated as proof of authorization in...

CVE-2026-24420 phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incomprehensive permissions check. The presence of a right key is improperly validated as proof of authorization in...