Is CVE-2026-46365 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46365 being exploited in the wild.

How severe is CVE-2026-46365?

Medium severity, with a CVSS score of 5.4, published 15 May 2026.

Which products and versions are affected?

phpmyfaq/phpmyfaq (Packagist) < 4.1.2, ECOSYSTEM:introduced=0,fixed=4.1.2; thorsten/phpmyfaq (Packagist) < 4.1.2, ECOSYSTEM:introduced=0,fixed=4.1.2; Thorsten phpMyFAQ < 4.1.2.

Is there a fix for CVE-2026-46365?

Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46365 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-46365?

Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46365: phpMyFAQ missing authorization in tag deletion API

Q: Is there a fix for CVE-2026-46365?

Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46365 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-46365?

Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46365 · Severity: medium · CVSS 5.4 · Published 2026-05-15

phpMyFAQ is an open-source FAQ software platform. A security flaw in the administrative interface allows any registered user, even those without administrative privileges, to permanently delete tags used to organize content. This can lead to data loss and disrupt how users navigate and search for information on the site.

Technologies: phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist), Thorsten phpMyFAQ. Vendors: Packagist, Thorsten.

Quick answers

Is CVE-2026-46365 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46365 being exploited in the wild.
How severe is CVE-2026-46365?: Medium severity, with a CVSS score of 5.4, published 15 May 2026.
Which products and versions are affected?: phpmyfaq/phpmyfaq (Packagist) < 4.1.2, ECOSYSTEM:introduced=0,fixed=4.1.2; thorsten/phpmyfaq (Packagist) < 4.1.2, ECOSYSTEM:introduced=0,fixed=4.1.2; Thorsten phpMyFAQ < 4.1.2.
Is there a fix for CVE-2026-46365?: Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46365 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-46365?: Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later
```
composer require phpmyfaq/phpmyfaq:^4.1.2
```
thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later
```
composer require thorsten/phpmyfaq:^4.1.2
```

Technical details

A missing authorization vulnerability exists in the TagController::delete() method within phpMyFAQ. The endpoint 'DELETE /admin/api/content/tags/{tagId}' only verifies that a user is authenticated via the userIsAuthenticated() check, but fails to verify specific administrative permissions (such as FAQ_EDIT). Consequently, any user with a valid session cookie—including regular frontend users—can send a DELETE request to remove any tag by its ID. This action also lacks CSRF protection. The vulnerability results in permanent data loss of tags and their associations. The issue is addressed in version 4.1.2 by implementing proper permission checks.

Affected products

phpMyFAQ phpMyFAQ < 4.1.2

Identifiers

CVE-2026-46365
GHSA-5h62-f8fg-4w7q
GHSA-7cx3-2qx2-3g6w

Timeline

2026-04-28: advisory: Initial internal advisory published by vendor
2026-05-15: disclosed: CVE-2026-46365 published
2026-05-15: patched: Fix released in version 4.1.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.