{"schema":"threatline.record/2","record":{"id":"GHSA-hj8v-cg6r-gg6q","aliases":["GHSA-hj8v-cg6r-gg6q"],"summary":"Category-restricted editors can modify attachments outside their allowed categories","details":"### Summary\r\n\r\nIn medium permission mode, attachment administration endpoints check global attachment permissions but do not enforce the category restrictions of the parent FAQ.\r\n\r\nA restricted editor can list, upload, and delete attachments belonging to FAQs outside the categories assigned to their group.\r\n\r\n### Details\r\n\r\nThe upload endpoint accepts a user-controlled `record_id` and `record_lang`, while deletion accepts an attachment ID. These operations only check `addattachment` or `delattachment`; they do not resolve the parent FAQ and verify its category.\r\n\r\nThis differs from GHSA-jmv9-23mw-mxpq, which covered unauthenticated metadata disclosure in 4.1.6. This report demonstrates authenticated cross-category modification.\r\n\r\n### PoC\r\n\r\n1. Enable medium permission mode.\r\n2. Give a test group `edit_faq`, `addattachment`, and `delattachment`, restricted to category A.\r\n3. Create a target FAQ in category B.\r\n4. Confirm that the user receives `403` when opening the target FAQ's edit page.\r\n5. Send an authenticated upload request with a valid CSRF token and the target FAQ's `record_id`.\r\n6. Observe `200 OK` and a new attachment on the unauthorized FAQ.\r\n7. Send a delete request for that attachment ID.\r\n8. Observe `200 OK` and that the attachment is removed.\r\n\r\n### Impact\r\n\r\nA category-restricted editor can tamper with or delete files belonging to FAQs outside their authorization scope. This can cause unauthorized content changes, loss of attachments, and partial service disruption.","categories":["Unclassified"],"product":"thorsten/phpmyfaq","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hj8v-cg6r-gg6q","source_modified_at":"2026-10-03T11:34:13Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"composer","name":"thorsten/phpmyfaq"},"range":"4.2.0-alpha.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hj8v-cg6r-gg6q","source_modified_at":"2026-10-03T11:34:13Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"composer","name":"thorsten/phpmyfaq"},"version":"4.2.0-beta"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-03T11:34:13Z","modified_at":"2026-10-03T11:34:13Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hj8v-cg6r-gg6q","fetched_at":"2026-10-23T18:55:00.935475Z","source_modified_at":"2026-10-03T11:34:13Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-03T11:34:13Z","content_hash":"6ee91fc28da32d5f544db2e3e7568470534d23708079d0c113e0d219ae9842ac"}}