CVE-2026-46365 phpMyFAQ - Missing Authorization in Tag Deletion Endpoint
Authenticated users can delete arbitrary tags in phpMyFAQ due to missing authorization checks, causing permanent data loss.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-46365?
CVE-2026-46365 is a medium-severity missing authorization vulnerability in thorsten phpmyfaq, published on 15 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpoint that allows any authenticated user to delete tags. Any logged-in user, including regular frontend users, can delete arbitrary tags by sending a DELETE request with a valid session cookie, resulting in permanent data loss and disruption of FAQ organization.
Weakness: CWE-862
Which versions are affected by CVE-2026-46365?
4 open source packages ship an affected version, including thorsten/phpmyfaq and phpmyfaq/phpmyfaq.
| Package | Affected | Fixed in |
|---|---|---|
thorsten/phpmyfaq Packagist | All versions | 4.1.2 |
thorsten/phpmyfaq Packagist | All versions | 4.1.2 |
phpmyfaq/phpmyfaq Packagist | All versions | 4.1.2 |
phpmyfaq/phpmyfaq Packagist | All versions | 4.1.2 |
How do I fix CVE-2026-46365?
Upgrade thorsten/phpmyfaq to 4.1.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-46365 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46365 exists.
Sources
Also known as GHSA-7cx3-2qx2-3g6w.