GHSA-7P9H-M7M8-VHHV
Vulnerability from github – Published: 2026-01-23 20:17 – Updated: 2026-01-28 04:43Summary
A logged‑in user without the dlattachment right can download FAQ attachments. This is due to a permissive permission check in attachment.php that treats the mere presence of a right key as authorization and a flawed group/user logic expression.
Details
In attachment.php, the access decision uses:
($groupPermission || ($groupPermission && $userPermission)) && isset($permission['dlattachment'])
isset() returns true even when the right value is false, and the logic simplifies to $groupPermission for some permission modes. As a result, a user without dlattachment can still access the attachment.
PoC
Precondition: A non‑admin user exists; an attachment is associated to a FAQ record; records.allowDownloadsForGuests = false. Log in as a non‑admin user without dlattachment. Request the attachment download endpoint.
curl -c /tmp/pmf_api_cookies.txt \
-H 'Content-Type: application/json' \
-d '{"username":"tester","password":"Test1234!"}' \
http://192.168.40.16/phpmyfaq/api/v3.0/login
curl -i -b /tmp/pmf_api_cookies.txt \
"http://192.168.40.16/phpmyfaq/index.php?action=attachment&id=1"
Impact
Unauthorized users can download attachments (confidentiality breach). Depending on content, this may expose sensitive documents.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.0.16"
},
"package": {
"ecosystem": "Packagist",
"name": "phpmyfaq/phpmyfaq"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.17"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.0.16"
},
"package": {
"ecosystem": "Packagist",
"name": "thorsten/phpmyfaq"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-24420"
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-23T20:17:16Z",
"nvd_published_at": "2026-01-24T03:16:00Z",
"severity": "MODERATE"
},
"details": "### Summary\nA logged\u2011in user without the dlattachment right can download FAQ attachments. This is due to a permissive permission check in attachment.php that treats the mere presence of a right key as authorization and a flawed group/user logic expression.\n\n### Details\nIn attachment.php, the access decision uses:\n```($groupPermission || ($groupPermission \u0026\u0026 $userPermission)) \u0026\u0026 isset($permission[\u0027dlattachment\u0027])```\nisset() returns true even when the right value is false, and the logic simplifies to $groupPermission for some permission modes. As a result, a user without dlattachment can still access the attachment.\n\n### PoC\nPrecondition: A non\u2011admin user exists; an attachment is associated to a FAQ record; records.allowDownloadsForGuests = false.\nLog in as a non\u2011admin user without dlattachment.\nRequest the attachment download endpoint.\n```\ncurl -c /tmp/pmf_api_cookies.txt \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\"username\":\"tester\",\"password\":\"Test1234!\"}\u0027 \\\n http://192.168.40.16/phpmyfaq/api/v3.0/login\n\ncurl -i -b /tmp/pmf_api_cookies.txt \\\n \"http://192.168.40.16/phpmyfaq/index.php?action=attachment\u0026id=1\"\n```\n\n### Impact\nUnauthorized users can download attachments (confidentiality breach). Depending on content, this may expose sensitive documents.",
"id": "GHSA-7p9h-m7m8-vhhv",
"modified": "2026-01-28T04:43:20Z",
"published": "2026-01-23T20:17:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7p9h-m7m8-vhhv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24420"
},
{
"type": "PACKAGE",
"url": "https://github.com/thorsten/phpMyFAQ"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.