A flaw in the authorization logic of phpMyFAQ allows any authenticated user, regardless of their role, to invoke the /api/setup/backup endpoint. The endpoint accepts authenticated requests but does not verify that the requester has administrative or configuration management privileges. As a result, a non‑admin user can trigger a system configuration backup and obtain the path to the generated ZIP file, potentially exposing sensitive configuration data. This weakness is a classic case of missing authorization enforcement.

The phpMyFAQ web application, managed by thorsten, is affected in versions 4.0.16 and earlier. The vendor has addressed the issue in version 4.0.17, which removes the unauthorized access to the backup API.

The vulnerability carries a CVSS score of 6.5, indicating medium severity. The EPSS score is below 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs to possess authenticated user credentials to exploit the flaw, implying that any legitimate user with a valid account can trigger the backup and potentially expose configuration data. No additional privilege escalation or remote code execution is required.