CVE-2026-75919

phpMyFAQ before 4.1.7 contains a missing-authentication vulnerability (CWE-306) in its SetupController, which leaves the setup API endpoints POST /api/setup/update-database and POST /api/setup/backup reachable without credentials when maintenance mode is enabled. An unauthenticated attacker with network access to the API can trigger database migrations (schema updates), turn maintenance mode off, and generate configuration backup ZIP archives. Those backup archives contain the instance's database credentials, giving the attacker sensitive secrets alongside the ability to alter the application's database and configuration; the CVSS 4.0 base score of 6.9 (Medium) reflects primarily low availability impact on the vulnerable system. All phpMyFAQ deployments running versions prior to 4.1.7 are affected, though practical exposure is limited to instances with maintenance mode enabled and an attacker-reachable setup API. No in-the-wild exploitation has been reported; a public advisory/PoC exists (GHSA-f96w-7fx2-79c8), CISA KEV listing is absent, and EPSS estimates a 0.5% probability of exploitation within 30 days.

What to do: Upgrade phpMyFAQ to 4.1.7 or later. As an interim mitigation, restrict access to /api/setup/* (for example at the web server or reverse proxy) and review whether maintenance mode must remain enabled. Check access logs for unauthenticated POST requests to /api/setup/update-database and /api/setup/backup, and rotate database credentials if backup archives may have been downloaded.