CVE-2026-85587CWE-863broken-access-control

CVE-2026-85587

published September 4, 2026

CVSS
5.3
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00364 · 29.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-04T16:17Z
References (3)
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6w97-49h8-58wh · [email protected]https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-incorrect-authorization-via-admin-pages · [email protected]https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6w97-49h8-58wh · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 11:29Z
    phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages
    cvelistv5