CVE-2026-75919

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7

Description An authentication bypass exists in the SetupController when maintenance mode is enabled. This allows unauthenticated remote attackers to execute database migrations and create configuration backups. Specifically, attackers can use the 'POST /api/setup/update-database' and 'POST /api/setup/backup' endpoints to perform database updates, disable maintenance mode, and extract database credentials from generated ZIP archives. This flaw can lead to unauthorized access to protected information and a denial of service.

Recommendations Update to version 4.1.7 or later.