Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-24421 EUVD-2026-4258GHSA-wm8h-26fv-mg7g

phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user

Published Jan 24, 2026 · Updated Jan 26, 2026 · Assigned by GitHub_M

Vendor: thorsten Product: phpMyFAQ Package: phpmyfaq/phpmyfaq Package: thorsten/phpmyfaq Ecosystem: Packagist

Description

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any authenticated user despite their permissions. SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. Non-admin users can trigger a configuration backup and retrieve its path. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP. This issue is fixed in version 4.0.17.

Affected products

VendorProductAffectedFixed
thorsten phpMyFAQ < 4.0.17 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist phpmyfaq/phpmyfaq < 4.0.17 4.0.17 GHSA-wm8h-26fv-mg7g
Packagist thorsten/phpmyfaq < 4.0.17 4.0.17 GHSA-wm8h-26fv-mg7g

References