CVE-2026-111900: Incorrect Authorization in thorsten phpMyFAQ

CVE-2026-111900 describes an improper authorization vulnerability in phpMyFAQ's attachment.php component. The vulnerability arises because the system does not verify whether the parent FAQ of an attachment is published or visible to the requester. Authenticated users who have the dlattachment permission can exploit this by requesting attachments via index.php?action=attachment&id=<ID>, thereby accessing files associated with draft FAQs that should not be accessible. This affects phpMyFAQ versions prior to 4.1.9 and versions from 4.2.0-alpha up to but not including 4.2.0-beta.

The vulnerability allows authenticated users with specific permissions to access and download attachments linked to draft FAQs that are not intended to be visible. This could lead to unauthorized disclosure of potentially sensitive or unpublished information contained in those attachments. The CVSS 4.0 base score is 5.3, indicating a medium severity impact with network attack vector, low complexity, and no user interaction required.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict or review dlattachment permissions to limit exposure.