CVE-2026-24420: 
PHP vulnerability analysis and mitigation

CVE-2026-24420 is a broken access control vulnerability in phpMyFAQ, an open-source FAQ web application, that allows authenticated users without the dlattachment permission to download FAQ attachments. It affects phpMyFAQ versions 4.0.16 and below (all versions prior to 4.0.17). The vulnerability was published on January 23–24, 2026, and patched in version 4.0.17. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is improper access control (CWE-284) in attachment.php, where the permission check uses a flawed conditional expression: ($groupPermission || ($groupPermission && $userPermission)) && isset($permission['dlattachment']). The isset() function returns true even when the dlattachment key exists with a false value, meaning the mere presence of the key is treated as authorization. Additionally, the outer logic simplifies to just $groupPermission in certain permission modes, bypassing the user-level check entirely. Exploitation requires only a valid authenticated session — no administrative privileges are needed — and a target FAQ record with an associated attachment where guest downloads are disabled (GitHub Advisory).

Successful exploitation allows authenticated users to download FAQ attachments they are not authorized to access, resulting in a confidentiality breach. Depending on the content of the attachments, this could expose sensitive internal documents, proprietary data, or personally identifiable information. There is no integrity or availability impact; the vulnerability is limited to unauthorized data disclosure (GitHub Advisory, Feedly).

A proof-of-concept (PoC) exploit is publicly available via the GitHub Security Advisory, demonstrating exploitation using standard curl commands. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.009% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a phpMyFAQ instance running version 4.0.16 or earlier. Confirm that at least one FAQ record has an associated attachment and that guest downloads are disabled (records.allowDownloadsForGuests = false).
2. Obtain credentials: Acquire valid credentials for any non-admin user account that does not have the dlattachment permission assigned.
3. Authenticate and obtain session cookie: Send a POST request to the phpMyFAQ REST API login endpoint to retrieve a session cookie.

   curl -c /tmp/pmf_api_cookies.txt \
     -H 'Content-Type: application/json' \
     -d '{"username":"tester","password":"Test1234!"}' \
     http://<target>/phpmyfaq/api/v3.0/login

4. Request attachment download: Use the session cookie to request the attachment download endpoint with a known attachment ID, bypassing the flawed permission check.

   curl -i -b /tmp/pmf_api_cookies.txt \
     "http://<target>/phpmyfaq/index.php?action=attachment&id=1"

5. Retrieve attachment: The server returns the attachment file due to the improper isset() check, granting unauthorized access to the document (GitHub Advisory).

• Network: Repeated HTTP GET requests to index.php?action=attachment&id=<N> from authenticated user accounts that do not normally access attachments; enumeration of sequential attachment IDs from a single session.
• Logs: Web server access logs showing successful (HTTP 200) responses to action=attachment requests from users without the dlattachment permission; unusual volume of attachment download requests from low-privilege accounts.
• Application Logs: phpMyFAQ application logs recording attachment access events for users whose permission profile does not include dlattachment.

The vendor has released phpMyFAQ version 4.0.17, which fixes the flawed permission check in attachment.php. All users running version 4.0.16 or earlier should upgrade to 4.0.17 immediately. As an interim measure, administrators should audit access logs for unauthorized attachment downloads, review and tighten user permission assignments, and consider restricting network-level access to the phpMyFAQ instance to trusted users only (GitHub Advisory, Feedly).

The vulnerability was reported by security researcher Brahim-Fouad and disclosed via GitHub's coordinated security advisory process. No significant vendor statements beyond the advisory, notable researcher commentary, or major media coverage have been identified at this time (GitHub Advisory).