CVE-2026-24421
phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user
MEDIUM 6.5EPSS 1.8%
phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any authenticated user despite their permissions. SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. Non-admin users can trigger a configuration backup and retrieve its path. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP. This issue is fixed in version 4.0.17.
- Affected
- thorsten · phpMyFAQ
- CVSS v3.1 GITHUB
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - EPSS
- 1.77% chance of exploitation in the next 30 days, 78th percentile
- Published
- 2026-01-24
- Updated
- 2026-01-26