Vulnerabilities

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to…

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

6.5

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-111910 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 10
   CVE NVD 14d ago

   phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT…

   CVSS 8.3 CVE-2026-111908
2. 8
   CVE NVD 14d ago

   phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch…

   CVSS 6.5 CVE-2026-111906 Elastic OpenSearch
3. 3
   CVE NVD 14d ago

   phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET…

   CVSS 6.0 CVE-2026-111905
4. 3
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open…

   CVSS 5.3 CVE-2026-111904
5. 3
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ…

   CVSS 5.3 CVE-2026-111902
6. 10
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API…

   CVSS 7.5 CVE-2026-111901
7. 3
   CVE NVD 14d ago

   phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify…

   CVSS 4.3 CVE-2026-111900
8. 22
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by…

   CVSS 7.5 CVE-2026-111898 Red Hat
9. 10
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments…

   CVSS 7.1 CVE-2026-111897
10. 21
    CVE NVD 14d ago

    phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by…

    CVSS 6.8 CVE-2026-111895 Microsoft
11. 8
    CVE NVD 14d ago

    phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content…

    CVSS 5.4 CVE-2026-111894 Oracle
12. 3
    CVE NVD 14d ago

    phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets…

    CVSS 6.5 CVE-2026-111893
13. 3
    CVE NVD 14d ago

    phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and…

    CVSS 5.5 CVE-2026-111891
14. 3
    CVE NVD 14d ago

    phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right…

    CVSS 5.5 CVE-2026-111890
15. 3
    CVE NVD 14d ago

    phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows…

    CVSS 4.3 CVE-2026-111889
16. 3
    CVE NVD 14d ago

    phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to…

    CVSS 5.3 CVE-2026-111887
17. 3
    CVE NVD 14d ago

    phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits…

    CVSS 5.5 CVE-2026-111885
18. 10
    CVE NVD 14d ago

    phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control…

    CVSS 8.3 CVE-2026-111884
19. 28
    CVE NVD 14d ago

    phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated…

    CVSS 8.1 CVE-2026-111882 Microsoft Red Hat