CVE-2026-111902: Authorization Bypass Through User-Controlled Key in thorsten phpMyFAQ

CVE-2026-111902 is an authorization bypass vulnerability in phpMyFAQ affecting versions >=4.2.0-alpha and <4.2.0-beta. The vulnerability exists in the isFaqAccessibleForUser() function, which incorrectly treats missing FAQ translations as accessible to unauthenticated users. By manipulating the Accept-Language HTTP header in requests to the comments and attachments API endpoints, an attacker can access comments and attachment listings for FAQs that are unpublished or restricted by access control lists (ACLs). This bypasses intended authorization checks and exposes potentially sensitive information.

The vulnerability allows unauthenticated attackers to bypass authorization controls and access comments and attachment listings associated with unpublished or ACL-restricted FAQs. This could lead to unauthorized disclosure of sensitive or confidential information stored in these comments and attachments. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact.

No official patch or vendor advisory is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints or implement additional access control checks to prevent unauthorized reading of comments and attachments. Monitor for updates from the phpMyFAQ project regarding a fix for this issue.