Medium severity5.3NVD Advisory· Published Aug 19, 2026

CVE-2026-75919

Description

phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backup endpoints to execute database updates, disable maintenance mode, and extract database credentials from generated ZIP archives.

Affected products

PhpMyAdmin/Phpmyfaqllm-create
Range: <4.1.7

Patches

Vulnerability mechanics

References

github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f96w-7fx2-79c8nvd
www.vulncheck.com/advisories/phpmyfaq-before-authentication-bypass-via-setup-apinvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000