CVE-2026-75919

Executive Summary

CVE-2026-75919 is an authentication bypass vulnerability in phpMyFAQ versions prior to 4.1.7, specifically in the SetupController component. When maintenance mode is enabled, unauthenticated attackers can invoke two API endpoints that permit database migration execution and configuration backup creation, potentially leading to arbitrary database schema changes, disabling of maintenance mode, and exfiltration of database credentials via generated ZIP archive downloads. The vulnerability is remotely exploitable over the network without authentication, though the CVSS score of 5.3 reflects limited direct impact on confidentiality and integrity, with the primary concern being availability. As of this report, no patch has been confirmed from any tracked source, and the vulnerability remains unpatched with a patch confidence rating of 0/4.

Technical Analysis

The vulnerability resides in the SetupController class of phpMyFAQ, an open-source FAQ management system written in PHP. The core issue is an authentication bypass that grants unauthenticated attackers access to administrative setup functionality when maintenance mode is enabled.

Root Cause Classification (CWE-306 — Missing Authentication for Critical Function): The SetupController fails to enforce authentication checks on certain POST endpoints. The NVD description explicitly identifies two vulnerable endpoints:

1. POST /api/setup/update-database — This endpoint triggers database migration routines, allowing an attacker to execute schema updates, potentially altering the database structure, injecting malicious data, or corrupting the installation.

2. POST /api/setup/backup — This endpoint generates a ZIP archive containing configuration backups. The description states that "database credentials" can be extracted from these generated archives, indicating that sensitive configuration data such as database host, username, password, and database name are included in the backup file.

Trigger Condition — Maintenance Mode: The vulnerability is only exploitable when maintenance mode is enabled on the target phpMyFAQ installation. Maintenance mode is typically a temporary state used during upgrades or migrations, which means the attack surface is time-limited but still significant during maintenance windows. This condition likely explains the relatively low CVSS availability score (A:L).

Attack Mechanism — Class Level: At the vulnerability class level, this is an authorization failure where the application fails to distinguish between privileged setup operations and public-facing API endpoints. The affected controller likely shares authentication middleware with other controllers, but the setup endpoints appear to be excluded or misconfigured. The attacker does not need to present any session token, API key, or credential — they simply issue HTTP POST requests to the vulnerable paths.

Technical Detail Limitations: The NVD description does not specify the exact authentication mechanism that should have protected these endpoints, nor does it provide the technical implementation details of how maintenance mode interacts with route authentication. Insufficient technical detail is available regarding whether the bypass is due to a misconfigured route prefix, a missing middleware registration, or a conditional authentication check that is improperly evaluated when a maintenance flag is set. Descriptions of exact code-level defects would require access to the source code diff between 4.1.6 and 4.1.7, which is not available in the data provided.

Exploitation Scenarios

Step 1 — Reconnaissance / Target Identification: An attacker identifies phpMyFAQ instances exposed to the internet. This can be accomplished via search engine dorking (e.g., http.title:"phpMyFAQ"), favicon hash matching, or by scanning for the default phpMyFAQ installation paths and response signatures. The attacker then determines whether the target has maintenance mode enabled, which could be indicated by a maintenance banner on the homepage or by observing that normal FAQ functionality returns maintenance-related HTTP responses.

Step 2 — Triggering the Flaw: The attacker sends a POST request to http://<target>/api/setup/update-database with no authentication headers or session cookies. Because the SetupController lacks proper authentication checks when maintenance mode is enabled, the request is processed. Alternatively, the attacker may send a POST request to http://<target>/api/setup/backup to initiate configuration backup generation.

Step 3 — Payload / Execution Method: For the database migration endpoint, the attacker may issue the POST request with minimal or no payload — the migration routine itself performs whatever database operations are configured in pending migrations. The attacker does not need to craft a specific SQL injection payload; the vulnerability is that the migration runner itself is invoked without authentication. For the backup endpoint, the attacker triggers ZIP archive generation, which the server then makes accessible for download, likely via a predictable filename or a URL returned in the HTTP response.

Step 4 — Post-Exploitation Impact:

• From the update-database endpoint: Database schema modifications could result in data loss, denial of service (database corruption), or planting of malicious triggers/procedures. The attacker can also potentially disable maintenance mode, thereby expanding the attack surface for additional exploitation of the now-exposed application.
• From the backup endpoint: The attacker extracts the generated ZIP archive to retrieve database credentials stored in the configuration. These credentials may enable direct database access if the database server is reachable from the attacker's position, and could serve as a stepping stone for lateral movement into the broader infrastructure if database credentials are reused.

It should be noted that no public PoC is available, and the attack chain is inferred from the vulnerability class and the endpoint behavior described in the NVD entry. The exact payload requirements and response formats remain unknown.

Impact Assessment

CVSS Analysis (Base Score: 5.3): The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L indicates:

• Attack Vector (AV:N): Exploitable remotely over the network.
• Attack Complexity (AC:L): No special conditions beyond maintenance mode being enabled; no race conditions or user interaction required.
• Privileges Required (PR:N): No authentication required.
• User Interaction (UI:N): None.
• Scope (S:U): Unchanged — impact is confined to the vulnerable component.
• Confidentiality (C:N): The CVSS score does not reflect information disclosure, though the backup endpoint inherently leaks configuration data. This apparent inconsistency suggests the CVSS score may underestimate the confidentiality impact, or the scoring was performed against the update-database endpoint alone.
• Integrity (I:N): Not scored for direct integrity impact.
• Availability (A:L): Low availability impact, likely reflecting the potential for database migration errors to corrupt the FAQ database.

Business Impact: For organizations running phpMyFAQ, exploitation during a maintenance window can result in:

1. Database credential theft: Direct extraction of database credentials enables further attacks against the underlying database, potentially affecting other applications sharing the same database server or credentials.
2. Service disruption: Malicious database migrations can corrupt the FAQ schema, requiring restoration from backups and causing prolonged downtime.
3. Maintenance mode manipulation: Disabling maintenance mode prematurely exposes an unprepared application to normal traffic, potentially serving inconsistent data during a partially-completed migration.

Blast Radius: The direct blast radius is limited to the phpMyFAQ installation. However, credential reuse across the infrastructure could broaden the impact to adjacent systems. The internal network position from which the application is hosted also becomes a pivot point if database credentials grant access to a database server that is otherwise restricted.

Detection Guidance

The following detection artifacts are derived from the specific endpoints and behaviors described in the NVD entry. All rules target the POST requests to /api/setup/update-database and /api/setup/backup paths.

Sigma Rule

title: phpMyFAQ Setup Endpoint Authentication Bypass Attempt
id: 0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated POST requests to phpMyFAQ setup API endpoints associated with CVE-2026-75919
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75919
author: vartersit.com Security Team
date: 2026/01/01
logsource:
    category: webserver
    product: apache
    definition: 'Requires web server access logs or reverse proxy logs'
detection:
    selection:
        cs-method: POST
        cs-uri-path:
            - '/api/setup/update-database'
            - '/api/setup/backup'
    condition: selection
falsepositives:
    - Legitimate administrative actions during authorized maintenance windows
level: high
tags:
    - attack.t1190
    - cve.2026.75919
    - cwe.306

YARA Rule

rule CVE_2026_75919_phpmyfaq_setup_bypass {
    meta:
        author = "vartersit.com Security Team"
        description = "Detects requests/scripts targeting phpMyFAQ setup endpoints for CVE-2026-75919"
        date = "2026-01-01"
        cve = "CVE-2026-75919"
        severity = "high"
    strings:
        $s1 = "POST /api/setup/update-database" ascii wide nocase
        $s2 = "POST /api/setup/backup" ascii wide nocase
        $s3 = "/api/setup/update-database" ascii wide nocase
        $s4 = "/api/setup/backup" ascii wide nocase
        $s5 = "update-database" ascii wide nocase
        $s6 = "phpmyfaq" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x50414D) and
        any of ($s1, $s2, $s3, $s4) and
        (any of ($s5) or any of ($s6))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT phpMyFAQ Setup Endpoint Authentication Bypass (CVE-2026-75919)";
    flow:established,to_server;
    http.method:"POST";
    http.uri;
    content:"/api/setup/";
    http.uri;
    content:"update-database";
    http.uri;
    content:"backup";
    classtype:attempted-admin;
    sid:202675919;
    rev:1;
    metadata:created_at 2026-01-01, updated_at 2026-01-01, cve CVE-2026-75919;
)

Note: The Suricata rule above covers both endpoints in a single rule. For separate rules, split into two distinct signatures — one matching /api/setup/update-database and one matching /api/setup/backup — to reduce false positive noise and allow independent alert tuning.

Elastic Detection

sequence by host.name with maxspan=5s
  [ network where event.type == "start" and
    destination.port == 80 or destination.port == 443 ]
  [ http where request.method == "POST" and
    url.path in ("/api/setup/update-database", "/api/setup/backup") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| where method="POST"
| search uri_path="/api/setup/update-database" OR uri_path="/api/setup/backup"
| stats count by src_ip, uri_path, status, useragent
| sort - count
| `alert_cve_2026_75919_setup_bypass`

Macro definition (optional):

[alert_cve_2026_75919_setup_bypass]
search = | table _time, src_ip, dest_ip, uri_path, status, useragent

Wazuh OSSEC Rule

<group name="web_application, cve_2026_75919,">
  <rule id="100759" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="url">/api/setup/update-database</field>
    <description>phpMyFAQ unauthenticated POST to update-database endpoint (CVE-2026-75919)</description>
    <group>authentication_failure,attack</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100760" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="url">/api/setup/backup</field>
    <description>phpMyFAQ unauthenticated POST to backup endpoint (CVE-2026-75919)</description>
    <group>authentication_failure,attack</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source has been observed as of this writing. The affected version range is listed as "Unknown / phpMyFAQ < 4.1.7," meaning all versions prior to 4.1.7 are presumed vulnerable. A fix may be included in version 4.1.7, but this could not be confirmed.

Immediate Mitigations (until patch availability is confirmed):

1. Disable maintenance mode as soon as active migration work is complete — the vulnerability is only exploitable while maintenance mode is enabled. Treat the maintenance window as a high-risk period and minimize its duration.
2. If maintenance mode must stay enabled, restrict network access to the phpMyFAQ instance using WAF rules or firewall policies that block external access to the /api/setup/ path. Allow-list only known administrative IP ranges.
3. Deploy the detection rules above (Sigma, Suricata, Splunk, Wazuh) to alert on any POST requests to /api/setup/update-database or /api/setup/backup, regardless of authentication status, and investigate all such events.
4. Review access logs retroactively for any prior requests to these endpoints during periods when maintenance mode was enabled.
5. Change database credentials immediately if any suspicion exists that the backup endpoint was accessed by an unauthorized party. Rotate credentials for any other systems that reuse the same passwords.

Patch / Upgrade Steps:

1. Monitor the official phpMyFAQ GitHub repository and project website for a security release that addresses CVE-2026-75919 or for version 4.1.7 (or later) publication.
2. Before upgrading, check release notes and changelogs for mentions of authentication fixes in SetupController.
3. When a patched version becomes available, upgrade all production instances in a controlled manner, testing in a staging environment first. Verify that the setup endpoints now require authentication.
4. If version 4.1.7 is already available, verify the fix by attempting an unauthenticated POST to the affected endpoints against a staging environment — a patched version should return an authentication error or HTTP 403/401.

Long-Term Hardening:

1. Reduce the attack surface by disabling or removing the setup controller from production deployments if the setup functionality is not required post-installation.
2. Implement a Web Application Firewall (WAF) rule that blocks all requests to /api/setup/* unless originating from approved administrative IP addresses.
3. Place phpMyFAQ behind a reverse proxy that enforces additional authentication layers, including HTTP Basic Auth or mutual TLS, for administrative paths.
4. Regularly update phpMyFAQ and subscribe to the project's security announcement mailing list or GitHub security advisories feed.
5. Audit all installed phpMyFAQ instances for version, ensuring none run versions older than 4.1.7 once the fix is confirmed.
6. Store database credentials in an external secrets manager rather than in configuration files if the application permits such integration.

References

The following references are based on available intelligence data. Some entries may require verification as details become available:

1. NVD Entry — CVE-2026-75919: https://nvd.nist.gov/vuln/detail/CVE-2026-75919 (primary authoritative source for this vulnerability)
2. phpMyFAQ Project Website: https://www.phpmyfaq.de/ (source of official release announcements; monitor for security-related news regarding CVE-2026-75919)
3. phpMyFAQ GitHub Repository: https://github.com/thorsten/phpMyFAQ (source of version 4.1.7 and commit history; check for security fixes related to SetupController)
4. CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html (category reference for the vulnerability class)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-75919 is NOT listed in the KEV catalog as of this report's date; re-check if status changes)

Exploit-in-the-Wild Evidence: None known at the time of writing. No public PoC, exploit code, or Nuclei template has been observed, and there is no evidence of active exploitation campaigns targeting this CVE. Organizations should nevertheless apply the detection rules provided above, as exploitation is feasible with minimal effort once a target in maintenance mode is identified.