diff --git a/typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php b/typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php
index f20bf618b8f85d47c5dc3dbd9cf91a35f6911486..0f091ffdef98f506929a153ca6d4a9c169b42815 100644
--- a/typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php
+++ b/typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php
@@ -1454,7 +1454,6 @@ abstract class AbstractUserAuthentication implements LoggerAwareInterface
      *
      * @param int $uid The UID of the backend user to set in ->user
      * @internal
-     * @see SC_mod_tools_be_user_index::compareUsers(), \TYPO3\CMS\Setup\Controller\SetupModuleController::simulateUser(), freesite_admin::startCreate()
      */
     public function setBeUserByUid($uid)
     {
diff --git a/typo3/sysext/core/Documentation/Changelog/master/Deprecation-86180-ProtectedMethodsInSetupModuleController.rst b/typo3/sysext/core/Documentation/Changelog/master/Deprecation-86180-ProtectedMethodsInSetupModuleController.rst
new file mode 100644
index 0000000000000000000000000000000000000000..c563f7792486e133fa82f4f10d67534f7e01279e
--- /dev/null
+++ b/typo3/sysext/core/Documentation/Changelog/master/Deprecation-86180-ProtectedMethodsInSetupModuleController.rst
@@ -0,0 +1,37 @@
+.. include:: ../../Includes.txt
+
+================================================================
+Deprecation: #86180 - Protected methods in SetupModuleController
+================================================================
+
+See :issue:`86180`
+
+Description
+===========
+
+The following methods of class :php:`TYPO3\CMS\Setup\Controller\SetupModuleController`
+changed their visibility from public to protected and should not be called any longer:
+
+* [not scanned] :php:`main()`
+* [not scanned] :php:`init()`
+* :php:`storeIncomingData()`
+
+
+Impact
+======
+
+Calling one of the above methods from an external object triggers a PHP :php:`E_USER_DEPRECATED` error.
+
+
+Affected Installations
+======================
+
+These methods are usually called internally only, extensions should not be affected by this.
+
+
+Migration
+=========
+
+Use the entry method :php:`mainAction()` that returns a PSR-7 response object.
+
+.. index:: Backend, PHP-API, PartiallyScanned, ext:setup
\ No newline at end of file
diff --git a/typo3/sysext/install/Configuration/ExtensionScanner/Php/MethodCallMatcher.php b/typo3/sysext/install/Configuration/ExtensionScanner/Php/MethodCallMatcher.php
index 6495fb4bcff38d3b765c227c0f04d4f5e152dba6..b7be20743753e3e3d45af2b220e3c7b0f80ffa55 100644
--- a/typo3/sysext/install/Configuration/ExtensionScanner/Php/MethodCallMatcher.php
+++ b/typo3/sysext/install/Configuration/ExtensionScanner/Php/MethodCallMatcher.php
@@ -3250,4 +3250,11 @@ return [
             'Deprecation-85996-ExtensionManagerCommandController.rst'
         ],
     ],
+    'TYPO3\CMS\Setup\Controller\SetupModuleController->storeIncomingData' => [
+        'numberOfMandatoryArguments' => 0,
+        'maximumNumberOfArguments' => 0,
+        'restFiles' => [
+            'Deprecation-86180-ProtectedMethodsInSetupModuleController.rst',
+        ],
+    ],
 ];
diff --git a/typo3/sysext/setup/Classes/Controller/SetupModuleController.php b/typo3/sysext/setup/Classes/Controller/SetupModuleController.php
index 873e3eedfc2d5cc9aa320f661d2c952ed126882c..fa9ddac32f67d53a1c14ee6331c3046a195be22e 100644
--- a/typo3/sysext/setup/Classes/Controller/SetupModuleController.php
+++ b/typo3/sysext/setup/Classes/Controller/SetupModuleController.php
@@ -22,6 +22,7 @@ use TYPO3\CMS\Backend\Routing\UriBuilder;
 use TYPO3\CMS\Backend\Template\ModuleTemplate;
 use TYPO3\CMS\Backend\Utility\BackendUtility;
 use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
+use TYPO3\CMS\Core\Compatibility\PublicMethodDeprecationTrait;
 use TYPO3\CMS\Core\Compatibility\PublicPropertyDeprecationTrait;
 use TYPO3\CMS\Core\Core\Environment;
 use TYPO3\CMS\Core\Crypto\PasswordHashing\InvalidPasswordHashException;
@@ -45,6 +46,7 @@ use TYPO3\CMS\Core\Utility\GeneralUtility;
 class SetupModuleController
 {
     use PublicPropertyDeprecationTrait;
+    use PublicMethodDeprecationTrait;
 
     /**
      * Flag if password has not been updated
@@ -72,7 +74,7 @@ class SetupModuleController
      *
      * @var array
      */
-    protected $deprecatedPublicProperties = [
+    private $deprecatedPublicProperties = [
         'OLD_BE_USER' => 'Using $OLD_BE_USER of class SetupModuleController from the outside is discouraged, the variable will be removed.',
         'MOD_MENU' => 'Using $MOD_MENU of class SetupModuleController from the outside is discouraged, the variable will be removed.',
         'MOD_SETTINGS' => 'Using $MOD_SETTINGS of class SetupModuleController from the outside is discouraged, the variable will be removed.',
@@ -81,6 +83,15 @@ class SetupModuleController
         'languageUpdate' => 'Using $languageUpdate of class SetupModuleController from the outside is discouraged, as this variable is only used for internal storage.',
     ];
 
+    /**
+     * @var array
+     */
+    private $deprecatedPublicMethods = [
+        'storeIncomingData' => 'Using SetupModuleController::storeIncomingData() is deprecated and will not be possible anymore in TYPO3 v10.',
+        'main' => 'Using SetupModuleController::main() is deprecated and will not be possible anymore in TYPO3 v10.',
+        'init' => 'Using SetupModuleController::init() is deprecated and will not be possible anymore in TYPO3 v10.',
+    ];
+
     /**
      * @var array
      */
@@ -215,7 +226,7 @@ class SetupModuleController
      * NOTICE: This method is called before the \TYPO3\CMS\Backend\Template\ModuleTemplate
      * is included. See bottom of document.
      */
-    public function storeIncomingData()
+    protected function storeIncomingData()
     {
         // First check if something is submitted in the data-array from POST vars
         $d = GeneralUtility::_POST('data');
@@ -342,7 +353,7 @@ class SetupModuleController
     /**
      * Initializes the module for display of the settings form.
      */
-    public function init()
+    protected function init()
     {
         $this->getLanguageService()->includeLLFile('EXT:setup/Resources/Private/Language/locallang.xlf');
         $backendUser = $this->getBackendUser();
@@ -376,7 +387,7 @@ class SetupModuleController
     /**
      * Generate the main settings form:
      */
-    public function main()
+    protected function main()
     {
         $uriBuilder = GeneralUtility::makeInstance(UriBuilder::class);
         $this->content .= '<form action="' . (string)$uriBuilder->buildUriFromRoute('user_setup') . '" method="post" id="SetupModuleController" name="usersetup" enctype="multipart/form-data">';
@@ -655,7 +666,8 @@ class SetupModuleController
     }
 
     /**
-     * Return a select with available languages
+     * Return a select with available languages.
+     * This method is called from the setup module fake TCA userFunc.
      *
      * @return string Complete select as HTML string or warning box if something went wrong.
      */
@@ -697,7 +709,8 @@ class SetupModuleController
     }
 
     /**
-     * Returns a select with all modules for startup
+     * Returns a select with all modules for startup.
+     * This method is called from the setup module fake TCA userFunc.
      *
      * @return string Complete select as HTML string
      */