# CVE-2026-111900: phpMyFAQ improper authorization in attachment.php

Source: https://junglewise.ai/threats/cve-2026-111900-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111900 · Severity: medium · CVSS 4.3 · Published 2026-10-17

phpMyFAQ is a frequently-asked-questions management system that allows organizations to publish and control access to knowledge bases. An authenticated user with attachment download permission can bypass publication controls and download complete files from draft FAQs that should be hidden, potentially exposing confidential or internal documentation before its intended release.

Technologies: [Phpmyfaq](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq-1). Vendors: [Phpmyfaq](https://junglewise.ai/threats/vendors/phpmyfaq).

## Quick answers

**Is CVE-2026-111900 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111900 being exploited in the wild.

**How severe is CVE-2026-111900?** Medium severity, with a CVSS score of 4.3, published 17 October 2026.

**Which products and versions are affected?** Phpmyfaq versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.

**Is there a fix for CVE-2026-111900?** Yes: fixed in phpMyFAQ 4.1.9, 4.2.0-beta. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111900 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111900?** Check whether you run Phpmyfaq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in phpMyFAQ 4.1.9, 4.2.0-beta

## Technical details

The attachment download endpoint in attachment.php fails to verify whether the parent FAQ is published or visible to the requester, only checking the attachment's own ACL and the dlattachment permission. An authenticated user with standard download-attachment rights can circumvent the FAQ publication boundary by directly requesting attachment files via index.php?action=attachment&id=<ID> or /attachment/X, bypassing the visibility checks applied to the FAQ page and API endpoints. Sequential attachment identifiers appearing in public links make discovery feasible.

## Affected products

- phpMyFAQ phpMyFAQ versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta

## Timeline

- 2026-10-17: disclosed
- 2026-10-03: advisory

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h76j-35m7-3mwq](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h76j-35m7-3mwq)
- [https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-draft-faq-attachment-disclosure-via-attachment-php](https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-draft-faq-attachment-disclosure-via-attachment-php)

## Related threats

- [phpMyFAQ insecure direct object reference in admin user API](https://junglewise.ai/threats/cve-2026-111905-phpmyfaq-3-2-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)
- [phpMyFAQ uncontrolled resource consumption in API pagination](https://junglewise.ai/threats/cve-2026-111901-phpmyfaq-4-2-0-alpha-before-4-2-0-beta-contains-an-uncontrolled)
- [phpMyFAQ authentication bypass in Microsoft Entra ID login](https://junglewise.ai/threats/cve-2026-111895-phpmyfaq-3-2-0-before-4-0-0-and-4-0-2-before-4-2-0-beta-contains)
- [phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP…](https://junglewise.ai/threats/cve-2026-76208-phpmyfaq-versions-3-1-0-through-4-1-6-contain-an-authentication)
- [phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()](https://junglewise.ai/threats/cve-2026-34729-phpmyfaq-stored-xss-via-regex-bypass-in-filter-removeattributes)