medium5.3
CVE-2026-85587
phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content.
Impact
phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public.
Affected products
| Product | Affected versions |
|---|---|
| PhpMyFAQ | before 4.1.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.