CVE-2026-24420 is a medium severity vulnerability with a CVSS score of 6.5. No known public exploits at this time.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
A logged‑in user without the dlattachment right can download FAQ attachments. This is due to a permissive permission check in attachment.php that treats the mere presence of a right key as authorization and a flawed group/user logic expression.
In attachment.php, the access decision uses:
($groupPermission || ($groupPermission && $userPermission)) && isset($permission['dlattachment'])
isset() returns true even when the right value is false, and the logic simplifies to $groupPermission for some permission modes. As a result, a user without dlattachment can still access the attachment.
Precondition: A non‑admin user exists; an attachment is associated to a FAQ record; records.allowDownloadsForGuests = false. Log in as a non‑admin user without dlattachment. Request the attachment download endpoint.
curl -c /tmp/pmf_api_cookies.txt \
-H 'Content-Type: application/json' \
-d '{"username":"tester","password":"Test1234!"}' \
http://192.168.40.16/phpmyfaq/api/v3.0/login
curl -i -b /tmp/pmf_api_cookies.txt \
"http://192.168.40.16/phpmyfaq/index.php?action=attachment&id=1"
Unauthorized users can download attachments (confidentiality breach). Depending on content, this may expose sensitive documents.
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.