CVE-2026-85587

5.3 Moyenne

Publiée le 04/09/2026 à 14:17 · Modifiée le 08/09/2026 à 22:05 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public.

Traduire en français

Produits concernés

thorsten phpMyFAQ

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.3 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-863

Références

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6w97-49h8-58wh
https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-incorrect-authorization-via-admin-pages
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6w97-49h8-58wh

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories