CVE-2026-75919: phpMyFAQ before 4.1.7 Authentication Bypass via Setup API
phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backup endpoints to execute database updates, disable maintenance mode, and extract database credentials from generated ZIP archives.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
phpMyFAQ installations before 4.1.7 are exposed when maintenance mode is enabled and the setup API endpoints are reachable over the network. No authentication or user interaction is required.
What can an unauthenticated attacker do?
An attacker can send POST requests to /api/setup/update-database and /api/setup/backup to run database migrations, disable maintenance mode, and generate configuration backups. The generated ZIP archives can expose database credentials.
What can be done if upgrading is not immediately possible?
Keep maintenance mode disabled and restrict network access to the affected setup API endpoints, particularly /api/setup/update-database and /api/setup/backup. This reduces exposure to the unauthenticated requests described.
How can I check for attempted exploitation?
Review web server and application logs for unauthenticated POST requests to /api/setup/update-database or /api/setup/backup. Also investigate unexpected database migrations, maintenance mode being disabled, or newly generated configuration backup ZIP archives.