CVE-2026-85587: Incorrect Authorization in thorsten phpMyFAQ

CVE-2026-85587 describes an authorization flaw in phpMyFAQ prior to version 4.1.8 where permission checks on administrative content pages are insufficient. This allows users with limited privileges, such as those with only add permissions, to access endpoints related to news editing and FAQ translation to view unpublished content that is normally hidden from public view. The vulnerability does not require user interaction and can be exploited remotely over the network.

Attackers with limited privileges can read draft and inactive content that should be restricted, potentially exposing sensitive or confidential information before it is published. This unauthorized disclosure could affect content confidentiality but does not allow modification or deletion of content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 4.1.8, upgrading to version 4.1.8 or later is likely recommended once official guidance is available. Until then, restrict user permissions carefully and monitor access to admin content pages.