CVE-2026-111900 Overview
CVE-2026-111900 is an improper authorization vulnerability [CWE-863] in phpMyFAQ affecting versions before 4.1.9 and the 4.2.0-alpha branch before 4.2.0-beta. The flaw resides in attachment.php, which fails to verify whether an attachment's parent FAQ entry is published or visible to the requester. Authenticated users holding the dlattachment permission can download complete attachment files that belong to unpublished draft FAQs by requesting predictable attachment identifiers.
Critical Impact
Authenticated low-privilege users can retrieve confidential attachments tied to draft FAQ articles that administrators have not yet released, enabling disclosure of sensitive internal documentation.
Affected Products
- phpMyFAQ versions prior to 4.1.9
- phpMyFAQ 4.2.0-alpha releases prior to 4.2.0-beta
- Deployments using the attachment.php download handler with the dlattachment permission granted to users
Discovery Timeline
- 2026-10-17 - CVE-2026-111900 published to the National Vulnerability Database
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-111900
Vulnerability Analysis
The vulnerability arises in the attachment download workflow of phpMyFAQ. When a user requests index.php?action=attachment&id=<ID>, the handler validates that the caller holds the dlattachment permission but does not inspect the publication state of the FAQ record that owns the attachment.
As a result, any authenticated account with download rights can enumerate numeric attachment identifiers and retrieve files linked to draft, hidden, or otherwise unreleased FAQ entries. This breaks the trust boundary administrators expect between draft content and user-visible content. The issue is categorized as improper authorization because the access check exists but is incomplete, missing a parent-object state check.
Root Cause
The handler evaluates the user's permission flag in isolation. It never joins the attachment record against the parent FAQ visibility, workflow status, or group access control list. Authorization decisions therefore rely only on "can this user download attachments?" instead of "can this user see the FAQ that owns this attachment?"
Attack Vector
An attacker needs a valid phpMyFAQ account with the dlattachment permission. The attacker iterates attachment IDs through requests such as index.php?action=attachment&id=1, id=2, and so on, then downloads every returned file regardless of the parent FAQ's publication state. No user interaction and no elevated privileges are required. The vulnerability does not permit modification or denial of service; impact is limited to confidentiality of draft attachments.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-h76j-35m7-3mwq and the VulnCheck Advisory on phpMyFAQ for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-111900
Indicators of Compromise
- Sequential or enumerated GET requests to index.php?action=attachment&id=<N> from a single authenticated session over a short time window.
- Download events in webserver logs for attachment IDs that correspond to FAQ entries still marked as draft or unpublished in the application database.
- Unexpected egress of attachment files to user accounts that do not own or edit the related FAQ content.
Detection Strategies
- Correlate phpMyFAQ application logs with database records to flag downloads where the parent FAQ active or visible flag is set to false.
- Deploy webserver or web application firewall rules that count distinct attachment&id= values per session and alert on enumeration patterns.
- Review audit trails for accounts with the dlattachment permission and baseline their normal download volume.
Monitoring Recommendations
- Enable verbose access logging on the phpMyFAQ frontend and forward logs to a centralized analytics platform for retention and search.
- Alert on authenticated sessions issuing more than a defined threshold of attachment requests per minute.
- Periodically audit which roles carry the dlattachment permission and whether that assignment is still justified.
How to Mitigate CVE-2026-111900
Immediate Actions Required
- Upgrade phpMyFAQ to version 4.1.9 or later on the stable branch, or to 4.2.0-beta or later if running the 4.2.0 alpha series.
- Review existing user accounts and remove the dlattachment permission from roles that do not strictly require attachment downloads.
- Audit recent webserver access logs for suspicious enumeration of the attachment action and investigate any confirmed draft content retrieval.
Patch Information
The maintainers addressed the issue in phpMyFAQ 4.1.9 and 4.2.0-beta. The fix adds authorization checks that verify the parent FAQ is published and visible to the requester before serving the attachment. Details are published in the GitHub Security Advisory GHSA-h76j-35m7-3mwq.
Workarounds
- Temporarily revoke the dlattachment permission from all non-administrative roles until the upgrade is applied.
- Restrict access to attachment.php and the action=attachment endpoint at the reverse proxy or web application firewall layer to trusted source networks.
- Avoid storing sensitive files as attachments on draft FAQ entries while the deployment remains unpatched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
