Medium severity5.3NVD Advisory· Published Aug 19, 2026· Updated Sep 1, 2026
CVE-2026-75919
CVE-2026-75919
Description
phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backup endpoints to execute database updates, disable maintenance mode, and extract database credentials from generated ZIP archives.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <4.1.7
Patches
Vulnerability mechanics
References
2- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f96w-7fx2-79c8nvdExploitVendor Advisory
- www.vulncheck.com/advisories/phpmyfaq-before-authentication-bypass-via-setup-apinvdThird Party Advisory
News mentions
1- PhpMyFAQ: 14 Vulnerabilities Including Auth Bypass Patched in Single DisclosureVypr Intelligence · Aug 19, 2026