phpMyFAQ versions prior to 4.1.7 contain an authentication bypass flaw in the SetupController. Because the API does not validate user authentication when maintenance mode is enabled, an unauthenticated attacker can trigger database migrations and backup operations. This bypass allows the attacker to modify application data, disable maintenance mode, and extract database credentials from backup ZIP files. The primary consequence is unauthorized access to the underlying database, which can lead to full data compromise.

The affected product is phpMyFAQ, a web‑based help desk and FAQ system. All installations running a phpMyFAQ instance version earlier than 4.1.7 are vulnerable. The vulnerability is activated when the 'maintenance mode' setting is enabled in the configuration. No other vendors or products are listed.

The CVSS v3 base score of 6.9 indicates a moderate severity. The EPSS score of 0.00397 (less than 1%) indicates a very low probability of exploitation, and the vulnerability is not in the CISA KEV catalog. Exploitation requires the application to be in maintenance mode, but otherwise no special conditions are reported. Attackers can use simple HTTP POST requests to /api/setup/update-database and /api/setup/backup to run migrations, disable maintenance mode, and download configuration archives that reveal database credentials. In practice, the attack surface is limited to users who can reach the setup API endpoints over the network.