Fluid Attacks Database

Description

Duplicate Advisory: phpMyFAQ: Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7cx3-2qx2-3g6w. This link is maintained to preserve external references.

Original Description

phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpoint that allows any authenticated user to delete tags. Any logged-in user, including regular frontend users, can delete arbitrary tags by sending a DELETE request with a valid session cookie, resulting in permanent data loss and disruption of FAQ organization.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
packagist	phpmyfaq/phpmyfaq	<0	4.1.2
packagist	thorsten/phpmyfaq	<0	4.1.2

Aliases

1. NVD-2026-463652. GHSA-7cx3-2qx2-3g6w3. GCVE-GHSA-5h62-f8fg-4w7q

References

1. https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7cx3-2qx2-3g6w2. https://www.vulncheck.com/advisories/phpmyfaq-missing-authorization-in-tag-deletion-endpoint

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.