PT-2026-41367 · Phpmyfaq · Phpmyfaq

Offset · CVE-2026-46365 · Published 2026-05-06 · Updated 2026-05-15

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.2

Description A missing authorization issue exists in the "DELETE /admin/api/content/tags/{tagId}" endpoint. This allows any authenticated user, including regular frontend users, to delete arbitrary tags by sending a DELETE request with a valid session cookie, which can lead to permanent data loss and disruption of FAQ organization. The vulnerable variable is {tagId}.

Recommendations Update to version 4.1.2 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-46365

GHSA-5H62-F8FG-4W7Q

GHSA-7CX3-2QX2-3G6W

Affected Products

Phpmyfaq

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46365.json · Exploit
• 🔥 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7cx3-2qx2-3g6w · Exploit
• https://osv.dev/vulnerability/GHSA-5h62-f8fg-4w7q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-46365 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7cx3-2qx2-3g6w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46365 · Security Note
• https://github.com/thorsten/phpMyFAQ · Note
• https://t.me/cveNotify/163692 · Telegram Post
• https://vulncheck.com/advisories/phpmyfaq-missing-authorization-in-tag-deletion-endpoint · Note