Cloudanix VulnDB

GHSA-7cx3-2qx2-3g6w

Medium · 5.4

phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags

CVSS

5.4

EPSS

—

Published

May 6, 2026

CISA due date

—

The record

The `TagController::delete()` endpoint at `DELETE /admin/api/content/tags/{tagId}` only verifies that the user is logged in (`userIsAuthenticated()`), but does not check any permission. Any authenticated user — including regular non-admin frontend users — can delete any tag by ID. This contrasts with `TagController::update()` and `TagController::search()`, which both enforce the `FAQ_EDIT` permission.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities