CVE-2026-46365: phpMyFAQ - Missing Authorization in Tag Deletion Endpoint
phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpoint that allows any authenticated user to delete tags. Any logged-in user, including regular frontend users, can delete arbitrary tags by sending a DELETE request with a valid session cookie, resulting in permanent data loss and disruption of FAQ organization.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46365?
CVE-2026-46365 is rated as a high-severity vulnerability due to the potential for unauthorized tag deletion by any authenticated user.
How do I fix CVE-2026-46365?
To mitigate CVE-2026-46365, upgrade phpMyFAQ to version 4.1.2 or later, which includes a fix for the missing authorization vulnerability.
Who is affected by CVE-2026-46365?
Any user of phpMyFAQ versions prior to 4.1.2, including regular frontend users, is affected by CVE-2026-46365.
What is the impact of CVE-2026-46365?
CVE-2026-46365 allows authenticated users to delete tags without proper authorization, compromising the integrity of content management.
Is there a workaround for CVE-2026-46365?
Implementing strict role-based access controls can serve as a temporary workaround for CVE-2026-46365 until an upgrade can be performed.