phpMyFAQ CVE-2026-111897

Requires an authenticated phpMyFAQ account operating as a category-restricted editor in 'medium permission mode' - the attacker must already be a legitimate but limited editor. Exploitation targets the attachment administration endpoints (upload and delete) and works by supplying an arbitrary record_id or attachment ID pointing to FAQs outside the editor's assigned categories. Limiting factors: valid editor credentials and the specific medium-permission editor role are prerequisites (PR:L), so the flaw is not reachable by anonymous/unauthenticated users; impact is confined to attachment integrity and limited availability on otherwise out-of-scope FAQs, with no confidentiality exposure.

This is a genuine but bounded risk, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reachability with low attack complexity and no user interaction, but critically requires PR:L - an attacker must already hold a valid category-restricted editor account in 'medium permission mode.' This is therefore an insider / compromised-low-privilege-account threat rather than an unauthenticated internet-facing bug. The 7.1 score is driven almost entirely by VI:H (integrity): an editor can tamper with or delete attachments on FAQs outside their authorized categories, with VA:L reflecting limited availability impact and VC:N (no confidentiality loss). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active or probable near-term exploitation. The signals are internally consistent - the description's 'editors supplying arbitrary record IDs' matches CWE-862 (Missing Authorization) and the PR:L/VI:H profile. Net: a real integrity/authorization flaw worth patching in the normal cycle, but the privilege prerequisite and absence of exploitation signals place it below unauthenticated RCE-class priorities.

A low-trust FAQ editor, scoped to only one content category in a phpMyFAQ 4.2.0-alpha deployment, sends attachment upload or delete requests to the administration endpoints while substituting a record_id or attachment ID belonging to another category's FAQ. Because the endpoint does not verify the editor's category authorization against the supplied ID, the attacker tampers with or deletes files on FAQs they should not control. No public exploit code is identified at time of analysis, and the low complexity means a motivated insider needs only to manipulate request parameters.