What is GHSA-gjx5-c2mr-w8c7?

GHSA-gjx5-c2mr-w8c7 is a security advisory published by GitHub Security Advisories with Medium severity. phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that...

Which CVE IDs does GHSA-gjx5-c2mr-w8c7 cover?

GHSA-gjx5-c2mr-w8c7 covers the following CVE IDs: CVE-2026-75919. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gjx5-c2mr-w8c7?

GHSA-gjx5-c2mr-w8c7 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-gjx5-c2mr-w8c7MediumCVSS 5.3

phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that...

Vendor

GitHub Security Advisories

Published

August 19, 2026

Last Modified

August 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-75919 →

📋 Description

phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backup endpoints to execute database updates, disable maintenance mode, and extract database credentials from generated ZIP archives.

🔗 References (4)

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f96w-7fx2-79c8
https://nvd.nist.gov/vuln/detail/CVE-2026-75919
https://www.vulncheck.com/advisories/phpmyfaq-before-authentication-bypass-via-setup-api
https://github.com/advisories/GHSA-gjx5-c2mr-w8c7