CVE-2026-24421: phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user
Summary Authenticated non‑admin users can call /api/setup/backup and trigger a configuration backup. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP.
Details SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. This allows any logged‑in user to create a sensitive backup and retrieve its path.
PoC Precondition: API enabled, any authenticated non‑admin user. - Log in as a non‑admin user. - Call backup endpoint. curl -c /tmp/pmfapicookies.txt \ -H 'Content-Type: application/json' \ -d '{"username":"tester","password":"Test1234!"}' \ http://192.168.40.16/phpmyfaq/api/v3.0/login
curl -i -b /tmp/pmfapicookies.txt \ -X POST --data '4.0.16' \ http://192.168.40.16/phpmyfaq/api/setup/backup
Impact Low‑privileged users can generate sensitive backups. If the ZIP is web‑accessible (server misconfiguration), this can lead to secret exposure.
Other sources
phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any authenticated user despite their permissions. SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. Non-admin users can trigger a configuration backup and retrieve its path. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP. This issue is fixed in version 4.0.17.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24421?
CVE-2026-24421 has a high severity rating due to the potential for unauthorized access to sensitive configuration data.
How do I fix CVE-2026-24421?
To fix CVE-2026-24421, upgrade to the latest version of phpMyFAQ, specifically version 4.0.17 or later.
Who is affected by CVE-2026-24421?
CVE-2026-24421 affects users of phpMyFAQ versions 4.0.16 and earlier.
What is the nature of the vulnerability in CVE-2026-24421?
CVE-2026-24421 is an authorization flaw that allows authenticated non-admin users to access the backup configuration feature.
What actions can be taken to mitigate CVE-2026-24421?
To mitigate CVE-2026-24421, implement access controls to restrict the use of the backup endpoint to admin users only.