CVE-2026-46365 describes a missing authorization vulnerability in phpMyFAQ prior to version 4.1.2. The issue exists in the DELETE /admin/api/content/tags/{tagId} API endpoint, which does not properly restrict tag deletion to authorized administrative users. Consequently, any authenticated user, including those with only frontend access, can delete arbitrary tags by issuing a DELETE request with a valid session cookie. This leads to unauthorized modification of FAQ content structure and potential data loss. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. No vendor patch or official remediation level is currently documented.

Exploitation allows any authenticated user to delete arbitrary tags from the phpMyFAQ system, causing permanent data loss and disruption of FAQ organization. This can degrade the integrity and usability of the FAQ content but does not directly impact confidentiality. Availability is affected due to disruption of content structure. There is no indication of privilege escalation or remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users carefully and monitor for unauthorized tag deletions. Consider implementing additional access controls or compensating controls at the application or network level to limit DELETE requests to authorized administrators only.