⚠ Withdrawn by GitHub Security Advisories

Withdrawn: June 9, 2026

GHSA-w9mj-gfrm-hj5xHighCVSS 6.5Disclosed before NVD

Duplicate Advisory: phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check

Published
May 15, 2026
Last Modified
June 9, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-hpgw-ww76-c68r. This link is maintained to preserve external references.

Original Description

phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after sending a forbidden response. Attackers can access all permission-protected admin pages by requesting their URLs as authenticated users, exposing admin logs, user data, system information, and application configuration.

🎯 Affected products2

  • composer/thorsten/phpmyfaq:< 4.1.2
  • composer/phpmyfaq/phpmyfaq:< 4.1.2

🔗 References (4)