# CVE-2026-24421: phpmyfaq — Fixed in 4.0.17

🐘

🐘 Packagist

Not in CISA KEV

MEDIUM severity

# CVE-2026-24421 — phpmyfaq

MEDIUM 

CVE-2026-24421 is a medium-severity (CVSS 6.5) CWE-862 vulnerability in phpmyfaq/phpmyfaq. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for phpmyfaq/phpmyfaq — see the affected versions and patch details below.

phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user

Also known as[GHSA-wm8h-26fv-mg7g](/vulnerability/GHSA-wm8h-26fv-mg7g)

Published

Jan 24, 2026

Updated

Oct 28, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

1 known

Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-24421.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

1.7%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs78th percentile — riskier than 78% of all scored CVEsHighest risk

0.00%0.76%1.53%2.29%0.3%1.7%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

2 pkgs affected

🐘`phpmyfaq/phpmyfaq`🐘`thorsten/phpmyfaq`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

## Description

#### Summary

Authenticated non‑admin users can call /api/setup/backup and trigger a configuration backup. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP.

#### Details

SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. This allows any logged‑in user to create a sensitive backup and retrieve its path.

#### PoC

Precondition: API enabled, any authenticated non‑admin user.

-   Log in as a non‑admin user.
-   Call backup endpoint.

```
curl -c /tmp/pmf_api_cookies.txt \
  -H 'Content-Type: application/json' \
  -d '{"username":"tester","password":"Test1234!"}' \
  http://192.168.40.16/phpmyfaq/api/v3.0/login

curl -i -b /tmp/pmf_api_cookies.txt \
  -X POST --data '4.0.16' \
  http://192.168.40.16/phpmyfaq/api/setup/backup
```

#### Impact

Low‑privileged users can generate sensitive backups. If the ZIP is web‑accessible (server misconfiguration), this can lead to secret exposure.

## Affected Packages

2 total 2 fixed

Ecosystem

Package

Vulnerable range

Fix

🐘Packagist

`phpmyfaq/phpmyfaq` 

all versions

4.0.17`composer require phpmyfaq/phpmyfaq:^4.0.17`

🐘Packagist

`thorsten/phpmyfaq` 

all versions

4.0.17`composer require thorsten/phpmyfaq:^4.0.17`

## Affected Products

1 product · 1 configurations

Application

`phpmyfaq`phpmyfaq

< 4.0.17

range

Exploits & PoCs

1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-52523webappsphp

phpMyFAQ 4.0.16 - Improper Authorization

by contact · Apr 29, 2026

[Exploit-DB](https://www.exploit-db.com/exploits/52523) [Source](https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/52523.txt)

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for phpmyfaq/phpmyfaq, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update phpmyfaq/phpmyfaq to 4.0.17 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-24421 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
    

## Frequently Asked Questions

\### Summary Authenticated non‑admin users can call /api/setup/backup and trigger a configuration backup. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP. ### Details SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. This allows any logged‑in user to create a sensitive backup and retrieve its path. ### PoC Precondition: API enabled, any authenticated non‑admin user. - Log in as a non‑admin user. - Call backup endpoint. \`\`\` curl -c /tmp/pmf\_api\_cookies.txt \\ -H 'Conten

O3 Security · Impact-Aware SCA

### Is CVE-2026-24421 in your dependencies?

Find it across Packagist, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)