CVE-2026-24420
Medium · 6.5phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)
CVSS
6.5
EPSS
0.5%
Published
Jan 23, 2026
CISA due date
—
The record
A logged‑in user without the dlattachment right can download FAQ attachments. This is due to a permissive permission check in attachment.php that treats the mere presence of a right key as authorization and a flawed group/user logic expression.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | phpmyfaq/phpmyfaq | 0 | 4.0.17 |
| Packagist | thorsten/phpmyfaq | 0 | 4.0.17 |
Related vulnerabilities
- CVE-2026-24421 phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing) Also affects phpmyfaq/phpmyfaq
- CVE-2026-24422 phpMyFAQ: Public API endpoints expose emails and invisible questions Also affects phpmyfaq/phpmyfaq
- GHSA-x2v3-9p22-w3x6 phpMyFAQ contains a CSV injection vulnerability Also affects phpmyfaq/phpmyfaq
- CVE-2023-53929 phpMyFAQ contains a CSV injection vulnerability Also affects phpmyfaq/phpmyfaq
- GHSA-fxm2-cmwj-qvx4 phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality Also affects phpmyfaq/phpmyfaq
- CVE-2025-62519 phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality Also affects phpmyfaq/phpmyfaq
- GHSA-w22q-m2fm-x9f4 phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint Also affects thorsten/phpmyfaq
- CVE-2026-27836 phpMyFAQ is an open source FAQ web application. Also affects thorsten/phpmyfaq