Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-75919phpMyFAQ before 4.1.7 Authentication Bypass via Setup API

Medium 5.3

In plain English

A medium-severity missing authentication in phpMyFAQ from thorsten. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 53.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backup endpoints to execute database updates, disable maintenance mode, and extract database credentials from generated ZIP archives.

Affected products (as reported)

Vendor	Product	Versions
thorsten	phpMyFAQ	0 – before 4.1.7

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-f96w-7fx2-79c8) vendor-advisory
VulnCheck Advisory: phpMyFAQ before 4.1.7 Authentication Bypass via Setup API third-party-advisory