CVE-2026-24420 phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

What is CVE-2026-24420?

CVE-2026-24420 is a medium-severity missing authorization vulnerability in Phpmyfaq Phpmyfaq, published on 24 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incomprehensive permissions check. The presence of a right key is improperly validated as proof of authorization in attachment.php. Additionally, the group and user permission logic contains a flawed conditional expression that may allow unauthorized access. This issue has been fixed in version

Weakness: CWE-284

Which versions are affected by CVE-2026-24420?

4 open source packages ship an affected version, including phpmyfaq/phpmyfaq and thorsten/phpmyfaq. It affects 1 product.

Products include Phpmyfaq Phpmyfaq.

How do I fix CVE-2026-24420?

Upgrade phpmyfaq/phpmyfaq to 4.0.17 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-24420 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24420 exists.

Other vulnerabilities in Phpmyfaq Phpmyfaq

• CVE-2023-0310 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq Critical 9.8
• CVE-2022-4407 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq Critical 9.8
• CVE-2017-11187 Security feature bypass in n/a Critical 9.8
• CVE-2026-76213 phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle Critical 9.1
• CVE-2026-76214 phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge Critical 9.1

All Phpmyfaq Phpmyfaq vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7p9h-m7m8-vhhv.