phpMyFAQ is an open-source FAQ web application widely used to manage frequently asked questions and related attachments. Versions 4.0.16 and earlier contain an improper access control vulnerability (CWE-284) identified as CVE-2026-24420. The vulnerability arises because the application’s attachment.php script improperly validates the presence of a 'right key' as sufficient proof of authorization to download attachments. Additionally, the logic governing group and user permissions contains flawed conditional expressions that fail to correctly enforce the 'dlattachment' permission. As a result, authenticated users without explicit download rights can access and download FAQ attachments they should not be authorized to view. The vulnerability does not require user interaction beyond authentication, and the attack vector is network-based. The CVSS v3.1 base score is 6.5 (medium severity), reflecting high confidentiality impact but no impact on integrity or availability. The vulnerability has been addressed in phpMyFAQ version 4.0.17 by correcting the permission checks and authorization logic. No public exploits or active exploitation campaigns have been reported to date.

For European organizations using phpMyFAQ versions prior to 4.0.17, this vulnerability poses a risk of unauthorized disclosure of sensitive or confidential information contained in FAQ attachments. This could include internal documentation, proprietary data, or personal information, potentially violating data protection regulations such as GDPR. The confidentiality breach could lead to reputational damage, regulatory penalties, and loss of trust. Since the vulnerability requires authentication, the risk is limited to users with some level of access, but insider threats or compromised accounts could exploit this flaw. The lack of impact on integrity and availability reduces the risk of service disruption or data tampering. However, organizations relying on phpMyFAQ for knowledge management should consider the sensitivity of their stored attachments and the potential consequences of unauthorized access.

European organizations should immediately upgrade phpMyFAQ installations to version 4.0.17 or later, where the vulnerability is fixed. If upgrading is not immediately feasible, implement strict access controls on the web application, including limiting authenticated user permissions to only those necessary. Conduct a thorough audit of user accounts and permissions to ensure no excessive rights are granted. Monitor access logs for unusual attachment download activity that could indicate exploitation attempts. Consider implementing web application firewalls (WAFs) with custom rules to detect and block suspicious requests to attachment.php. Additionally, review and sanitize all FAQ attachments to ensure no sensitive information is unnecessarily exposed. Regularly update and patch phpMyFAQ and related components to mitigate similar vulnerabilities.