CVE-2026-75919: phpMyFAQ Auth Bypass Vulnerability

CVE-2026-75919 Overview

CVE-2026-75919 is an authentication bypass vulnerability in phpMyFAQ versions before 4.1.7. The flaw resides in the SetupController component and exposes privileged setup endpoints without requiring authentication when maintenance mode is enabled. Unauthenticated attackers can invoke POST /api/setup/update-database and POST /api/setup/backup to execute database migrations, disable maintenance mode, and generate configuration backups. The backup archives contain database credentials, giving remote attackers a path to further compromise. The vulnerability is classified under [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Remote unauthenticated attackers can trigger database migrations and download ZIP backups containing database credentials from any phpMyFAQ instance in maintenance mode.

Affected Products

phpMyFAQ versions prior to 4.1.7
Deployments with maintenance mode enabled
Instances exposing /api/setup/* endpoints to untrusted networks

Discovery Timeline

2026-08-19 - CVE-2026-75919 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75919

Vulnerability Analysis

phpMyFAQ is an open-source FAQ management system written in PHP. The SetupController handles installation and upgrade operations, including database schema migrations and configuration backups. In versions before 4.1.7, the controller fails to enforce authentication on two API routes when the application is in maintenance mode. The behavior likely stems from an implicit assumption that maintenance mode implies administrator context. Attackers can exploit this gap remotely over the network without credentials or user interaction.

Successful exploitation yields two primary outcomes. First, calling POST /api/setup/update-database runs database migrations and can disable maintenance mode. Second, calling POST /api/setup/backup produces a ZIP archive containing the application's configuration files, including database connection credentials. The information disclosure enables lateral movement into the backing database, where attackers can read or modify FAQ content, user data, and session material.

Root Cause

The root cause is missing authentication for critical functions [CWE-306]. Route handlers in SetupController do not validate an authenticated administrator session before processing setup requests when maintenance mode is active. Setup endpoints should require administrative authentication regardless of application state.

Attack Vector

Exploitation requires network access to the phpMyFAQ HTTP interface. An attacker sends unauthenticated POST requests to /api/setup/update-database and /api/setup/backup. The backup endpoint returns a ZIP archive with sensitive configuration data. No specialized tooling is required beyond a standard HTTP client. See the GitHub Security Advisory GHSA-f96w-7fx2-79c8 and the VulnCheck Advisory for phpMyFAQ for full technical detail.

Detection Methods for CVE-2026-75919

Indicators of Compromise

Unauthenticated HTTP POST requests to /api/setup/update-database in web server access logs
Unauthenticated HTTP POST requests to /api/setup/backup returning ZIP responses
Unexpected transitions of the phpMyFAQ instance out of maintenance mode
Newly generated backup archives in the phpMyFAQ data directory that do not correlate with administrator activity

Detection Strategies

Alert on any request to /api/setup/* paths that lacks an authenticated administrator session cookie
Correlate database schema changes with the source IP of /api/setup/update-database requests
Compare current phpMyFAQ version against 4.1.7 across the estate to identify vulnerable installations

Monitoring Recommendations

Enable verbose access logging on the web server hosting phpMyFAQ and forward logs to a central SIEM
Monitor egress traffic for ZIP downloads originating from setup endpoints
Track maintenance mode state changes and administrative configuration file access

How to Mitigate CVE-2026-75919

Immediate Actions Required

Upgrade phpMyFAQ to version 4.1.7 or later
Disable maintenance mode on production instances until the upgrade is applied
Rotate any database credentials that may have been exposed through the backup endpoint
Restrict network access to /api/setup/* routes using reverse proxy or firewall rules

Patch Information

The maintainers fixed the issue in phpMyFAQ 4.1.7. Administrators should apply the upgrade following the guidance in the GitHub Security Advisory GHSA-f96w-7fx2-79c8.

Workarounds

Block external access to /api/setup/update-database and /api/setup/backup at the reverse proxy or WAF layer
Keep maintenance mode disabled except during controlled upgrade windows performed from trusted networks
Place phpMyFAQ behind an authenticated proxy or VPN during any maintenance activity

bash

# Example nginx configuration to block setup API access from untrusted networks
location ~ ^/api/setup/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://phpmyfaq_backend;
}