The vulnerability CVE-2026-46365 in phpMyFAQ before version 4.1.2 is due to missing authorization checks on the DELETE /admin/api/content/tags/{tagId} API endpoint. This allows any authenticated user to delete tags regardless of their privilege level. The issue can lead to permanent deletion of tags, impacting the organization and integrity of FAQ content. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

Any logged-in user can delete arbitrary tags, causing permanent data loss and disruption of FAQ organization. This can degrade the usability and management of the FAQ system but does not directly impact confidentiality. The availability of FAQ content is affected due to tag deletions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user access to trusted users only and monitor for unauthorized tag deletions. Avoid granting unnecessary login permissions to untrusted users.