GitHub Security Advisory: GHSA-99qv-g4x9-mgc3
Package: thorsten/phpmyfaq (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 4.1.1
Patched in: 4.1.2

Summary: phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query

Details:
## Summary

The public `/solution_id_{id}.html` route calls `Faq::getIdFromSolutionId()` in `phpmyfaq/src/phpMyFAQ/Faq.php:1312`. That query joins `faqdata` with `faqcategoryrelations` solely by `solution_id` and returns the matching FAQ's `id`, `lang`, `thema` (title), and `category_id` with no permission filter. An unauthenticated visitor hits the route with a sequential integer and the server 301-redirects to `/content/<category>/<id>/<lang>/<title-slug>.html`, leaking the FAQ's existence, internal id, language, category binding, and title via the redirect's `Location` header and the redirected page's canonical link, share-to-social URLs, and hidden form fields. The related `getFaqBySolutionId()` at line 1221 contains an explicit fallback query (added "for tests") that also bypasses the permission filter, widening the blast radius to any callsite that trusts its result.

## Details

### The sink: `getIdFromSolutionId()` has no permission filter

`phpmyfaq/src/phpMyFAQ/Faq.php:1312`:

```php
public function getIdFromSolutionId(int $solutionId): array
{
    $query = sprintf(
        'SELECT fd.id, fd.lang, fd.thema AS question, fd.content, fcr.category_id
         FROM %sfaqdata fd
         LEFT JOIN %sfaqcategoryrelations fcr
           ON fd.id = fcr.record_id AND fd.lang = fcr.record_lang
         WHERE fd.solution_id = %d',
        Database::getTablePrefix(),
        Database::getTablePrefix(),
        $solutionId,
    );
    // ...
}
```

No `WHERE`-clause permission filter, no group/user filter. Every callsite that trusts this method exposes restricted FAQs. The route at `phpmyfaq/src/phpMyFAQ/Controller/Frontend/FaqController.php:172` uses this result to compute a slugified URL and 301-redirects to it:

```php
#[Route(path: '/solution_id_{solutionId}.html', name: 'public.faq.solution', methods: ['GET'])]
public function solution(Request $request): Response
{
    $solutionId = Filter::filterVar($request->attributes->get('solutionId'), FILTER_VALIDATE_INT, 0);
    // ...
    $faqData = $this->faq->getIdFromSolutionId($solutionId);
    if ($faqData === []) {
        return new Response('', Response::HTTP_NOT_FOUND);
    }
    $slug = TitleSlugifier::slug($faqData['question']);
    $url = sprintf('/content/%d/%d/%s/%s.html',
        $faqData['category_id'], $faqData['id'], $faqData['lang'], $slug);
    return new RedirectResponse($url, Response::HTTP_MOVED_PERMANENTLY);
}
```

The redirect URL embeds the title slug, so an unauthenticated visitor observes the title directly even though the canonical `/content/<...>.html` page may deny rendering the body.

### Related sink: `getFaqBySolutionId()` explicitly falls back without the filter

`phpmyfaq/src/phpMyFAQ/Faq.php:1256-1265`:

```php
if (false === $row || null === $row) {
    // Fallback without permission filter to ensure retrieval in non-authenticated contexts (e.g., tests)
    $fallbackQuery = sprintf(
        'SELECT * FROM %sfaqdata fd WHERE fd.solution_id = %d LIMIT 1',
        Databa