phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user

Root

Cause

The SetupController.php uses userIsAuthenticated() on the /api/setup/backup endpoint but fails to verify that the requester has configuration or admin permissions [1][3]. This means the endpoint checks only authentication, not authorization, and any logged-in user can access it regardless of their assigned role.

Exploitation

An attacker who is authenticated as a low-privileged user can call the backup endpoint via an HTTP POST request. The official advisory demonstrates the PoC: after logging in as a non-admin user, sending a POST to /api/setup/backup triggers a configuration backup and returns a link to the generated ZIP file [3]. No additional privileges or special access is required.

Impact

By exploiting this flaw, an attacker gains access to a backup of the phpMyFAQ configuration. The backup may contain sensitive information such as database credentials, encryption keys, or other secrets. If the web server is misconfigured and the ZIP is stored in a web-accessible directory, the backup can be directly downloaded, leading to exposure of confidential data [3].

Mitigation

The vulnerability is fixed in phpMyFAQ version 4.0.17 [1][3]. Users running any earlier version should upgrade immediately to the patched release. No workaround is mentioned in the sources; upgrading guide; updating is the recommended action.