EUVD-2026-30600
GHSA-5h62-f8fg-4w7q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpoint that allows any authenticated user to delete tags. Any logged-in user, including regular frontend users, can delete arbitrary tags by sending a DELETE request with a valid session cookie, resulting in permanent data loss and disruption of FAQ organization.
AnalysisAI
Authenticated users without administrative privileges can delete FAQ tags via phpMyFAQ's DELETE /admin/api/content/tags/{tagId} endpoint. The vulnerability affects versions before 4.1.2 and stems from missing authorization checks that allow any logged-in user, including regular frontend users, to permanently delete arbitrary tags using only a valid session cookie. While CVSS rates this 5.4 (Medium), the permanent data loss and FAQ organization disruption represent material operational impact. No active exploitation confirmed (not in CISA KEV), but publicly available exploit code exists per VulnCheck advisory and GitHub security advisory GHSA-7cx3-2qx2-3g6w, lowering exploitation barriers for authenticated attackers.
Technical ContextAI
phpMyFAQ is an open-source multilingual FAQ management system written in PHP. The vulnerability exists in the TagController::delete() method in phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/TagController.php (lines 121-133). The endpoint uses userIsAuthenticated() which only verifies the user's logged-in state via isLoggedIn() check, but lacks userHasPermission(PermissionType::FAQ_EDIT) authorization enforcement present in the update() and search() methods of the same controller. This represents CWE-862 (Missing Authorization), a horizontal privilege escalation where authenticated users can perform administrative operations without proper role verification. The admin API shares the same session bootstrap as the frontend (admin/api/index.php), meaning frontend user session cookies are valid for admin API requests. No middleware-level authorization layer exists in the Kernel to prevent this cross-context session reuse. Additionally, the endpoint lacks CSRF token validation present in TagController::update(), though the primary flaw is the missing role-based access control rather than CSRF protection.
RemediationAI
Upgrade to phpMyFAQ version 4.1.2 immediately, available via composer update or direct download from the GitHub repository referenced in advisory GHSA-7cx3-2qx2-3g6w at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7cx3-2qx2-3g6w. The patch adds proper userHasPermission(PermissionType::FAQ_EDIT) authorization checks to the TagController::delete() method, aligning it with the update() and search() methods. If immediate patching is not possible, implement these compensating controls: disable public user registration to limit the authenticated user pool to trusted administrators only (edit configuration settings in config/constants.php or admin interface), or apply a reverse proxy rule (nginx/Apache) to block HTTP DELETE requests to /admin/api/content/tags/* from non-administrative source IPs, though this IP-based filtering is fragile if admin sessions are hijacked or admins use dynamic IPs. Neither workaround is sufficient long-term - the missing authorization check requires code-level remediation. Monitor authentication logs for unexpected DELETE requests to /admin/api/content/tags/ endpoints and audit tag deletion activity in application logs to detect potential exploitation. After upgrading, verify existing tags have not been deleted by comparing current tag inventory against backups.
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated high severity (CVSS 8.8), th
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today