Executive brief
phpMyFAQ is an open-source FAQ software platform. A security flaw in the administrative interface allows any registered user, even those without administrative privileges, to permanently delete tags used to organize content. This can lead to data loss and disrupt how users navigate and search for information on the site.
Technical details
A missing authorization vulnerability exists in the TagController::delete() method within phpMyFAQ. The endpoint 'DELETE /admin/api/content/tags/{tagId}' only verifies that a user is authenticated via the userIsAuthenticated() check, but fails to verify specific administrative permissions (such as FAQ_EDIT). Consequently, any user with a valid session cookie—including regular frontend users—can send a DELETE request to remove any tag by its ID. This action also lacks CSRF protection. The vulnerability results in permanent data loss of tags and their associations. The issue is addressed in version 4.1.2 by implementing proper permission checks.
Affected products
- phpMyFAQ phpMyFAQ < 4.1.2
Timeline
- 2026-04-28: advisory: Initial internal advisory published by vendor
- 2026-05-15: disclosed: CVE-2026-46365 published
- 2026-05-15: patched: Fix released in version 4.1.2