CVE-2026-111897

7.1High

Published 17 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity
Weakness: CWE-862

Impact

Authenticated category-restricted editors can tamper with or delete attachments on arbitrary FAQs outside their assigned scope. Attackers only need valid medium-permission credentials to manipulate record IDs in attachment requests.

Root cause

The attachment administration endpoints fail to verify whether the requesting editor has category permissions for the target record ID.

Affected systems

phpMyFAQ 4.2.0-alpha before 4.2.0-beta

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Fix & remediation

Upgrade phpMyFAQ to version 4.2.0-beta or later. If updating immediately is not possible, temporarily revoke editor access for untrusted accounts or restrict network access to the admin interface.

shell

$ composer update phpmyfaq/phpmyfaq

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111897