CVE-2026-24420: phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

January 23, 2026 (updated January 28, 2026)

A logged‑in user without the dlattachment right can download FAQ attachments. This is due to a permissive permission check in attachment.php that treats the mere presence of a right key as authorization and a flawed group/user logic expression.

References

github.com/advisories/GHSA-7p9h-m7m8-vhhv
github.com/thorsten/phpMyFAQ
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7p9h-m7m8-vhhv
nvd.nist.gov/vuln/detail/CVE-2026-24420

Code Behaviors & Features

Detect and mitigate CVE-2026-24420 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →