CVE-2026-111897 is a high severity (CVSS 7.1) authorization bypass in phpMyFAQ 4.2.0-alpha before 4.2.0-beta. Category-restricted editors can upload and delete attachments on FAQs outside their categories. Upgrade to 4.2.0-beta, which the advisory lists as the patched version. The sections below cover affected versions, how to check, and what to do first.
What's affected
phpMyFAQ 4.2.0-alpha before 4.2.0-beta, per the record. The GitHub advisory lists the affected version as 4.2.0-alpha.2 and the patched version as 4.2.0-beta, so the sources agree.
Only installs running in medium permission mode with category-restricted groups are exposed. The upload endpoint accepts a record ID and language chosen by the caller, and the delete endpoint accepts an attachment ID.
Scoring note: the record's 7.1 is a CVSS 3.1 base score. VulnCheck's advisory also lists 7.1 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Check your version:
composer show phpmyfaq/phpmyfaq
Then check whether you use medium permission mode and category restrictions for editor groups. If you do not, the bypass has nothing to bypass.
Review recent attachment changes on FAQs outside each editor group's assigned categories.
What to do now
- Find your phpMyFAQ version and permission mode.
- Upgrade to 4.2.0-beta or later.
- Audit attachment uploads and deletions across categories.
- Restore removed attachments from backups and remove unexpected ones.
- Review which groups hold add and delete attachment permissions.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Do not stop at one host. Write down every place the affected software runs, including test servers, forgotten containers and copies bundled inside other products. Then rank them by exposure: anything reachable from the internet comes first, internal systems next. A short inventory now saves hours when the next advisory lands.
Why it matters
This is CWE-862, missing authorization. The attachment endpoints check the global permission to add or delete attachments but never resolve the parent FAQ and check its category. Category restrictions only mean something if every route that touches an FAQ's content honours them.
The advisory contrasts it with an earlier issue about metadata disclosure. This one is about modification, and the attacker already has an editor account. It is not listed in CISA KEV.
Quick check
What is medium permission mode?
The advisory describes a mode in which editor access is limited by category. The flaw lets editors step outside those limits for attachments.
Which version fixes it?
4.2.0-beta, according to the record and the GitHub advisory.
Sources
Last reviewed: 18 October 2026.
