CVE-2026-75919
Received Received - Intake

phpMyFAQ Authentication Bypass via SetupController Endpoints

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backup endpoints to execute database updates, disable maintenance mode, and extract database credentials from generated ZIP archives.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75919
EUVD
EUVD-2026-62444

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in phpMyFAQ versions before 4.1.7. It allows unauthenticated attackers to bypass security controls when maintenance mode is enabled. Attackers can access two API endpoints to execute database migrations, disable maintenance mode, and create configuration backups containing sensitive database credentials.

Detection Guidance

Check for unauthorized access to POST /api/setup/update-database and POST /api/setup/backup endpoints. Inspect web server logs for suspicious POST requests to these paths. Verify if maintenance mode was disabled unexpectedly. Look for unexpected ZIP archives in phpMyFAQ directories containing database.php files.

Impact Analysis

An attacker could exploit this to gain unauthorized access to your phpMyFAQ system, modify or delete database contents, disable maintenance mode, and steal sensitive database credentials stored in configuration backups. This could lead to further compromise of your application or data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.7 or later immediately. Disable maintenance mode if enabled. Review and restrict access to /api/setup endpoints. Monitor for unauthorized database migrations or backup creation. Check for exposed ZIP archives containing sensitive credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75919. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart