https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 08:04:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-266549 EUVD-2026-266549 https://cve.radiocsirt.org/vuln/euvd-2026-266549 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24420 <p>phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incomprehensive permissions check. The presence of a right key is improperly validated as proof of authorization in attachment.php. Additionally, the group and user permission logic contains a flawed conditional expression that may allow unauthorized access. This issue has been fixed in version</p> <p>phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incomprehensive permissions check. The presence of a right key is improperly validated as proof of authorization in attachment.php. Additionally, the group and user permission logic contains a flawed conditional expression that may allow unauthorized access. This issue has been fixed in version</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-24420 https://cve.radiocsirt.org/vuln/ghsa-7p9h-m7m8-vhhv <p><strong>Affected:</strong> Packagist: phpmyfaq/phpmyfaq, Packagist: thorsten/phpmyfaq</p> <p>### Summary A logged‑in user without the dlattachment right can download FAQ attachments. This is due to a permissive permission check in attachment.php that treats the mere presence of a right key as authorization and a flawed group/user logic expression.</p> <p>### Details In attachment.php, the access decision uses: ```($groupPermission || ($groupPermission &amp;&amp; $userPermission)) &amp;&amp; isset($permission[&#39;dlattachment&#39;])``` isset() returns true even when the right value is false, and the logic simplifies to $groupPermission for some permission modes. As a result, a user without dlattachment can still access the attachment.</p> <p>### PoC Precondition: A non‑admin user exists; an attachment is associated to a FAQ record; records.allowDownloadsForGuests = false. Log in as a non‑admin user without dlattachment. Request the attachment download endpoint. ``` curl -c /tmp/pmf_api_cookies.txt \ -H &#39;Content-Type: application/json&#39; \ -d &#39;{&#34;username&#34;:&#34;tester&#34;,&#34;password&#34;:&#34;Test1234!&#34;}&#39; \ http://192.168.40.16/phpmyfaq/api/v3.0/login</p> <p>curl -i -b /tmp/pmf_api_cookies.txt \ &#34;http://192.168.40.16/phpmyfaq/index.php?action=attachment&amp;id=1&#34; ```</p> <p>### Impact Unauthorized users can download attachments (confidentiality breach). Depending on content, this may expose sensitive documents.</p> <p><strong>Affected:</strong> Packagist: phpmyfaq/phpmyfaq, Packagist: thorsten/phpmyfaq</p> <p>### Summary A logged‑in user without the dlattachment right can download FAQ attachments. This is due to a permissive permission check in attachment.php that treats the mere presence of a right key as authorization and a flawed group/user logic expression.</p> <p>### Details In attachment.php, the access decision uses: ```($groupPermission || ($groupPermission &amp;&amp; $userPermission)) &amp;&amp; isset($permission[&#39;dlattachment&#39;])``` isset() returns true even when the right value is false, and the logic simplifies to $groupPermission for some permission modes. As a result, a user without dlattachment can still access the attachment.</p> <p>### PoC Precondition: A non‑admin user exists; an attachment is associated to a FAQ record; records.allowDownloadsForGuests = false. Log in as a non‑admin user without dlattachment. Request the attachment download endpoint. ``` curl -c /tmp/pmf_api_cookies.txt \ -H &#39;Content-Type: application/json&#39; \ -d &#39;{&#34;username&#34;:&#34;tester&#34;,&#34;password&#34;:&#34;Test1234!&#34;}&#39; \ http://192.168.40.16/phpmyfaq/api/v3.0/login</p> <p>curl -i -b /tmp/pmf_api_cookies.txt \ &#34;http://192.168.40.16/phpmyfaq/index.php?action=attachment&amp;id=1&#34; ```</p> <p>### Impact Unauthorized users can download attachments (confidentiality breach). Depending on content, this may expose sensitive documents.</p> https://cve.radiocsirt.org/vuln/ghsa-7p9h-m7m8-vhhv