phpMyFAQ versions prior to 4.1.2 contain an authorization bypass vulnerability in the TagController delete endpoint. The DELETE /admin/api/content/tags/{tagId} endpoint only verifies that the user is authenticated but does not check for the required FAQ_EDIT permission. This allows any authenticated user, including non-admin frontend users, to delete any tag by ID. The vulnerability leads to permanent deletion of tags and their associations, disrupting FAQ organization and navigation. A patch is available in version 4.1.2 that adds proper permission and CSRF token checks.