phpMyFAQ EUVD-2026-103320

Attacker must hold a valid, authenticated phpMyFAQ account that has been granted the 'dlattachment' (attachment download) permission; with that privilege they request index.php?action=attachment&id=<ID> to retrieve attachments whose parent FAQ is a draft or otherwise not visible to them. Exploitation is limited to confidentiality of draft-FAQ attachment files only (no modification or disruption), applies to phpMyFAQ versions before 4.1.9 and the 4.2.0-alpha line before 4.2.0-beta, and requires the privileged account up front, so anonymous/unauthenticated access is not possible.

This is a moderate, confidentiality-only information disclosure issue, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (Medium) and is internally consistent with the description: network-reachable, low attack complexity, but requires an authenticated account (PR:L) holding the 'dlattachment' permission. Impact is limited to low confidentiality (VC:L) with no integrity or availability effect, matching CWE-863 improper authorization where an already-privileged user accesses draft content they should not see. No EPSS score, KEV listing, or POC was provided in the input; there is no public exploit identified at time of analysis, and no evidence of active exploitation. The practical barrier is meaningful - the attacker must already possess a valid account with the attachment-download privilege, so exposure is largely limited to semi-trusted insiders or compromised low-privilege accounts rather than anonymous internet attackers. Net: a legitimate access-control bug worth patching in routine cycles, but not a drop-everything vulnerability. Note: the 'Authentication Bypass' tag is imprecise - the flaw is an authorization (access-control) failure for an already-authenticated user, not a bypass of authentication.

An authenticated phpMyFAQ user who has been granted the 'dlattachment' permission (for example a contributor or low-trust editor) requests index.php?action=attachment&id=<ID>, iterating attachment IDs. Because attachment.php never checks whether the parent FAQ is published or visible to the requester, the server returns complete attachment files belonging to unpublished draft FAQs, disclosing content intended to remain hidden. No public exploit code is referenced, but the request is trivially constructed by hand.