CVE-2026-24421

MEDIUM

phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-24421 has a selected CVSS score of 6.5 (medium); EIP currently links 1 catalogued exploit.

Description

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any authenticated user despite their permissions. SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. Non-admin users can trigger a configuration backup and retrieve its path. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP. This issue is fixed in version 4.0.17.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 26, 2026 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

phpMyFAQ

Browse thorsten / phpMyFAQ
CVE List< 4.0.17affected

phpmyfaq/phpmyfaq

Browse Packagist / phpmyfaq/phpmyfaq
GitHub AdvisoryBefore 4.0.17 · Fixed in 4.0.17affected

thorsten/phpmyfaq

Browse Packagist / thorsten/phpmyfaq
GitHub AdvisoryBefore 4.0.17 · Fixed in 4.0.17affected

Proofs of concept

1

Catalogued exploits

ExploitDBphpMyFAQ 4.0.16 - Improper AuthorizationExploitDB exploitby contactScanner1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides curl commands that demonstrate how an authenticated non-admin user can trigger a configuration backup via the /api/setup/backup endpoint and observe the response containing a link to the generated ZIP. It does not include code to extract, download, or otherwise exploit the backup; it only validates the missing authorization by showing the endpoint returns a successful response with a backup path.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a plaintext description of an improper authorization vulnerability (CVE-2026-24421) in phpMyFAQ. It contains no executable code, no obfuscated payloads, and no instructions for the reviewer to perform any action beyond reading. The curl commands are standard HTTP requests that demonstrate the vulnerability against a target server, not against the reviewer's machine. No backdoor, deceptive payload, or concealed harmful behavior is present.

ClassificationScanner
Model confidence95%
AuthenticationRequired
Languagesshell
Target softwarephpMyFAQ
Attack typesmissing authorization
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact only demonstrates triggering the backup endpoint and observing the response containing a backup path. It does not include any code to download, extract, or otherwise exploit the backup file. The description explicitly states the endpoint 'returns a link/path to the generated ZIP' and the impact notes that exposure requires a separate server misconfiguration. The provided curl commands serve to validate the missing authorization, which is characteristic of a scanner.

exploits/php/webapps/52523.txt:12exploits/php/webapps/52523.txt:32exploits/php/webapps/52523.txt:35

Requirements

  • API must be enabled on the target phpMyFAQ instanceexploits/php/webapps/52523.txt:18
  • Attacker must have valid credentials for a non-admin userexploits/php/webapps/52523.txt:18

Observed behavior

  • Logs in as a non-admin user via the API login endpointexploits/php/webapps/52523.txt:21-24
  • Sends a POST request to /api/setup/backup to trigger backup generationexploits/php/webapps/52523.txt:27-29
  • Observes the API response which includes a link/path to the generated ZIP backupexploits/php/webapps/52523.txt:32
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Curl Command
Payload withheldDemonstrates authentication step for the PoC; targets a remote server, not the reviewer's machine.exploits/php/webapps/52523.txt:21-24
Curl Command
Payload withheldDemonstrates the exploit step; triggers backup generation on a remote server, not on the reviewer's machine.exploits/php/webapps/52523.txt:27-29
Vulnerability Description
Payload withheldThe PoC describes a legitimate vulnerability in a third-party application; no backdoor or deceptive payload is embedded in the PoC itself.exploits/php/webapps/52523.txt:1-38
Review boundaries

What the analysis did not establish

  • Only the single text file from ExploitDB was analyzed; no external resources or referenced tools were inspected.
  • The artifact does not include code to download or extract the backup, so exploitation impact is not demonstrated.
  • Only the supplied text file was reviewed; no external resources, tools, or libraries referenced in the PoC were fetched or analyzed.
  • Binary content is flagged as not analyzed, but no binary files are present in this evidence packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3