CVE-2026-111910: phpMyFAQ Authorization Bypass Vulnerability

CVE-2026-111910 Overview

CVE-2026-111910 is an authorization bypass vulnerability in phpMyFAQ versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta. The flaw resides in attachment.php, which fails to enforce per-record permission checks when serving attachment downloads. Low-privileged users holding the dlattachment right can enumerate attachment IDs and retrieve files tied to restricted FAQs. When allowDownloadsForGuests is enabled, anonymous users can perform the same action without authentication. The weakness is categorized under CWE-862: Missing Authorization.

Critical Impact

Attackers can download confidential attachments from restricted FAQs by bypassing per-record access controls, exposing sensitive documents stored in phpMyFAQ.

Affected Products

• phpMyFAQ versions before 4.1.9
• phpMyFAQ 4.2.0-alpha versions before 4.2.0-beta
• Deployments with allowDownloadsForGuests enabled (anonymous exposure)

Discovery Timeline

• 2026-10-17 - CVE-2026-111910 published to NVD
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-111910

Vulnerability Analysis

phpMyFAQ supports attaching files to individual FAQ entries, and each FAQ record can be marked as restricted so that only authorized groups or users may view the content. The attachment.php endpoint serves these files when supplied with an attachment ID. In vulnerable releases, the endpoint evaluates whether the requester holds the dlattachment right or whether allowDownloadsForGuests is enabled, but it does not verify that the requester is authorized to view the parent FAQ. The result is that any requester satisfying the download gate can retrieve attachments belonging to any FAQ, including restricted entries that would otherwise be hidden from the user interface.

Root Cause

The vulnerability stems from an incomplete authorization check in the attachment download handler. Access control is applied at the global capability level rather than at the per-record level. Attachments inherit the permission context of their parent FAQ, but attachment.php does not re-evaluate that context before streaming file contents. This is a textbook missing authorization issue tracked under CWE-862.

Attack Vector

Exploitation requires only network access to the phpMyFAQ instance. A low-privileged authenticated user with the dlattachment right requests sequential or guessed attachment IDs through attachment.php and receives the file contents directly. If administrators enable allowDownloadsForGuests, no authentication is required and anonymous attackers can harvest restricted attachments. The attack produces no visible errors because the endpoint returns valid file data. See the GitHub Security Advisory GHSA-pp67-9fv9-ph7q and the VulnCheck Advisory for phpMyFAQ for technical details.

Detection Methods for CVE-2026-111910

Indicators of Compromise

• Repeated HTTP GET requests to attachment.php with sequential or enumerated id parameters originating from a single session or IP.
• Successful attachment downloads associated with user accounts that lack view permission on the parent FAQ record.
• Anonymous requests to attachment.php that return 200 OK with non-trivial response bodies when allowDownloadsForGuests is enabled.

Detection Strategies

• Correlate web server access logs for attachment.php requests against the phpMyFAQ permission database to flag downloads of restricted FAQ attachments.
• Alert on high-volume attachment ID enumeration patterns from a single source, which indicate scraping of the attachment namespace.
• Review authentication state in application logs to identify guest downloads of attachments linked to restricted content.

Monitoring Recommendations

• Enable verbose logging in phpMyFAQ to capture requester identity, attachment ID, and parent FAQ ID for each download event.
• Forward web server and application logs to a centralized analytics platform for retroactive hunting once patches are applied.
• Baseline normal attachment access volumes per user role to make unauthorized retrieval patterns easier to spot.

How to Mitigate CVE-2026-111910

Immediate Actions Required

• Upgrade phpMyFAQ to version 4.1.9 or 4.2.0-beta or later as soon as possible.
• Disable allowDownloadsForGuests until the upgrade is complete to remove the unauthenticated attack path.
• Audit the dlattachment right assignment and revoke it from accounts that do not require attachment access.

Patch Information

The maintainers released fixes in phpMyFAQ 4.1.9 and 4.2.0-beta. These versions add per-record authorization checks in attachment.php so that attachment downloads honor the permission settings of the parent FAQ. Patch details are documented in the GitHub Security Advisory GHSA-pp67-9fv9-ph7q.

Workarounds

• Set allowDownloadsForGuests to false in the phpMyFAQ configuration to require authentication before any attachment download.
• Restrict the dlattachment permission to trusted roles only and audit existing group assignments.
• Place attachment.php behind a reverse proxy rule that enforces authentication and rate-limits enumeration attempts until the patch is deployed.

# Configuration example: disable guest downloads via phpMyFAQ admin settings
# In the admin UI: Configuration -> Main Configuration -> Downloads
#   allowDownloadsForGuests = false
#
# Equivalent SQL update against the phpMyFAQ configuration table:
UPDATE faqconfig
  SET config_value = 'false'
  WHERE config_name = 'main.allowDownloadsForGuests';