CVE-2026-85587: phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages

Severity: medium (CVSS 5.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-04 · updated 2026-09-08
Weakness: CWE-863

Description

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public.

Affected products

thorsten phpMyFAQ: before 4.1.8 — fixed in 4.1.8

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.1.8. Check the vendor advisory for mitigations.

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6w97-49h8-58wh
https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-incorrect-authorization-via-admin-pages
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6w97-49h8-58wh

Get alerted when CVE-2026-85587 or the next vulnerability affects your stack