thorsten/phpmyfaq: Category-restricted editors can modify attachments outside their allowed categories

Summary

In medium permission mode, attachment administration endpoints check global attachment permissions but do not enforce the category restrictions of the parent FAQ.

A restricted editor can list, upload, and delete attachments belonging to FAQs outside the categories assigned to their group.

Details

The upload endpoint accepts a user-controlled record_id and record_lang, while deletion accepts an attachment ID. These operations only check addattachment or delattachment; they do not resolve the parent FAQ and verify its category.

This differs from GHSA-jmv9-23mw-mxpq, which covered unauthenticated metadata disclosure in 4.1.6. This report demonstrates authenticated cross-category modification.

PoC

1. Enable medium permission mode.
2. Give a test group edit_faq, addattachment, and delattachment, restricted to category A.
3. Create a target FAQ in category B.
4. Confirm that the user receives 403 when opening the target FAQ's edit page.
5. Send an authenticated upload request with a valid CSRF token and the target FAQ's record_id.
6. Observe 200 OK and a new attachment on the unauthorized FAQ.
7. Send a delete request for that attachment ID.
8. Observe 200 OK and that the attachment is removed.

Impact

A category-restricted editor can tamper with or delete files belonging to FAQs outside their authorization scope. This can cause unauthorized content changes, loss of attachments, and partial service disruption.