Executive brief
phpMyFAQ is a popular FAQ management system used to create and publish frequently asked questions and news announcements. A permission enforcement bug allows junior content editors (with limited "add" permissions) to view draft and inactive news items and FAQs that should remain hidden from them and the public, resulting in exposure of unpublished announcements and deactivated content.
Technical details
This vulnerability stems from incorrect permission-constant mappings in the News and FAQ admin controllers (CWE-863: Incorrect Authorization). The GET /admin/news/edit/{id} endpoint checks for NEWS_ADD permission instead of NEWS_EDIT, and GET /admin/faq/translate/{faqId}/{lang} checks for FAQ_ADD instead of the dedicated FAQ_TRANSLATE permission. An attacker with only "add news" or "add FAQ" rights can access these endpoints over the network to retrieve full content of draft/inactive items that return 404 on public paths. The permission guards are fail-closed (terminate on mismatch) but validate the wrong constant. Patches are available in phpMyFAQ 4.1.8 and later.
Affected products
- phpMyFAQ phpMyFAQ before 4.1.8
Timeline
- 2026-08-20: disclosed
- 2026-09-04: advisory