CVE-2026-85587 PUBLISHED

phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages

Assigner: VulnCheck
Reserved: 04.09.2026 Published: 04.09.2026 Updated: 04.09.2026

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor thorsten
Product phpMyFAQ
Versions Default: unaffected
  • affected from 0 to 4.1.8 (excl.)
  • Version 4.1.8 is unaffected

Credits

  • skeletonsec reporter

References

Problem Types

  • Incorrect Authorization CWE