Is CVE-2026-111900 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111900 being exploited in the wild.

How severe is CVE-2026-111900?

Medium severity, with a CVSS score of 4.3, published 17 October 2026.

Which products and versions are affected?

Phpmyfaq versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.

Is there a fix for CVE-2026-111900?

Yes: fixed in phpMyFAQ 4.1.9, 4.2.0-beta. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111900 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111900?

Check whether you run Phpmyfaq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111900: phpMyFAQ improper authorization in attachment.php

CVE-2026-111900 · Severity: medium · CVSS 4.3 · Published 2026-10-17

phpMyFAQ is a frequently-asked-questions management system that allows organizations to publish and control access to knowledge bases. An authenticated user with attachment download permission can bypass publication controls and download complete files from draft FAQs that should be hidden, potentially exposing confidential or internal documentation before its intended release.

Technologies: Phpmyfaq. Vendors: Phpmyfaq.

Quick answers

Is CVE-2026-111900 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111900 being exploited in the wild.
How severe is CVE-2026-111900?: Medium severity, with a CVSS score of 4.3, published 17 October 2026.
Which products and versions are affected?: Phpmyfaq versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.
Is there a fix for CVE-2026-111900?: Yes: fixed in phpMyFAQ 4.1.9, 4.2.0-beta. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111900 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111900?: Check whether you run Phpmyfaq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: phpMyFAQ 4.1.9, 4.2.0-beta

Technical details

The attachment download endpoint in attachment.php fails to verify whether the parent FAQ is published or visible to the requester, only checking the attachment's own ACL and the dlattachment permission. An authenticated user with standard download-attachment rights can circumvent the FAQ publication boundary by directly requesting attachment files via index.php?action=attachment&id=<ID> or /attachment/X, bypassing the visibility checks applied to the FAQ page and API endpoints. Sequential attachment identifiers appearing in public links make discovery feasible.

Affected products

phpMyFAQ phpMyFAQ versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta

Timeline

2026-10-17: disclosed
2026-10-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.