CVE-2026-24421VulnerabilityPublished 24 Jan 2026Updated 26 Jan 2026

CVE-2026-24421: thorsten phpMyFAQ · Missing Authorization

Affects thorsten phpMyFAQSource CVE Database V5

Not known to be exploited · public exploit available (Exploit-DB) · CVSS 6.5 Medium : upgrade to 4.0.17 as a priority.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

6.5Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 1.7% chance of exploitation in 30 days – higher than 77% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 4.0.17

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 24 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: evidence found.
1 Exploit-DB entry, 95 days after disclosure
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by GitHub_M
2026-01-2218:19Z, 31 hours before disclosure
CVE published
on cve.org
2026-01-2401:43Z, t = 0
In Threat Radar
record ingested
2026-01-2401:50Z, 8 minutes after disclosure
First Exploit-DB entry (opens in a new tab)
phpMyFAQ 4.0.16 - Improper Authorization
2026-04-29, 95 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade phpMyFAQ and thorsten/phpMyFAQ to 4.0.17.

Affected software

Product	Affected	Fixed in
thorstenphpMyFAQ	Affected <4.0.17	Fixed in 4.0.17
GitHubthorsten/phpMyFAQ`pkg:github/thorsten/phpMyFAQ`Other threats	Affected <4.0.17	Fixed in 4.0.17

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Organizations should immediately upgrade phpMyFAQ installations to version 4.0.17 or later, where the authorization checks have been properly implemented. Until the upgrade can be performed, restrict access to the /api/setup/backup endpoint by implementing network-level controls such as IP whitelisting or VPN-only access. Review and tighten user privilege assignments to ensure that only trusted administrators have authentication credentials capable of accessing the backup functionality. Monitor access logs for unusual or unauthorized backup requests. Additionally, consider implementing web application firewalls (WAFs) with custom rules to detect and block unauthorized API calls to the backup endpoint. Conduct regular audits of configuration backups to ensure no sensitive data is unnecessarily exposed. Finally, educate administrators and users about the importance of applying security patches promptly.

Description

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any authenticated user despite their permissions. SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. Non-admin users can trigger a configuration backup and retrieve its path. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP. This issue is fixed in version 4.0.17.

Impact

For European organizations using phpMyFAQ versions below 4.0.17, this vulnerability poses a significant risk of unauthorized disclosure of sensitive configuration data. Exposure of backup files could lead to leakage of database credentials, internal configuration details, or other sensitive information that attackers could leverage for further compromise or lateral movement within the network. This is particularly critical for organizations that rely on phpMyFAQ to manage internal knowledge bases or customer support information, as the confidentiality of their infrastructure could be undermined. The vulnerability does not directly affect system integrity or availability but can facilitate subsequent attacks. Given the medium CVSS score and the ease of exploitation by any authenticated user, organizations with weak access controls or publicly accessible authentication endpoints are at higher risk. The impact is amplified in sectors with strict data protection regulations such as GDPR, where unauthorized data exposure can lead to regulatory penalties and reputational damage.

Summary

The vulnerability identified as CVE-2026-24421 affects phpMyFAQ, an open-source FAQ web application, specifically versions prior to 4.0.17. The root cause is a missing authorization check in the SetupController.php file, where the /api/setup/backup endpoint only verifies if a user is authenticated via userIsAuthenticated(), but does not confirm if the user has the necessary administrative or configuration permissions. This allows any authenticated user, including those with limited privileges, to invoke the backup functionality and retrieve a link to a ZIP file containing configuration backups. Since the backup may contain sensitive information such as database credentials, configuration settings, or other internal data, unauthorized access could lead to confidentiality breaches. The CVSS 3.1 score is 6.5 (medium), reflecting that the attack vector is network-based, requires low privileges, no user interaction, and impacts confidentiality but not integrity or availability. The vulnerability does not require user interaction and affects all installations running vulnerable versions exposed to authenticated users. The flaw was addressed in version 4.0.17 by adding proper authorization checks to ensure only users with admin rights can access the backup endpoint.

CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
OWASP Cheat Sheets
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.8 (opens in a new tab)
V13.4.2 (opens in a new tab)
V7.2.2 (opens in a new tab)
Attack patterns
Exploitation of Thunderbolt Protection Flaws (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

github.com/thorsten/phpMyFAQ/security/advisories/GHSA-wm8h-26fv-mg7g (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 31 Jan 2026, 08:54 UTC

Public exploits and detection1 Exploit-DB entry

WeaknessesCWE-862

Technical details

References

Community reviews

Related threats