CVE-2026-46365— phpMyFAQ - Missing Authorization in Tag Deletion Endpoint
Possible ATT&CK Techniques 1AI
T1136.003 · Cloud AccountGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-46365
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
phpMyFAQ - Missing Authorization in Tag Deletion Endpoint
Source: NVD (National Vulnerability Database)
Vulnerability Description
phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpoint that allows any authenticated user to delete tags. Any logged-in user, including regular frontend users, can delete arbitrary tags by sending a DELETE request with a valid session cookie, resulting in permanent data loss and disruption of FAQ organization.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
phpMyFAQ 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
phpMyFAQ是Thorsten Rinne个人开发者的一个多语言、完全由数据库驱动的常见问题解答系统。 phpMyFAQ 4.1.2之前版本存在安全漏洞，该漏洞源于DELETE /admin/api/content/tags/{tagId}端点缺少授权，可能导致任何经过身份验证的用户（包括普通前端用户）通过发送带有有效会话cookie的DELETE请求删除任意标签，导致永久数据丢失和FAQ组织中断。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-46365
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-46365
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-46365 (2)
Same Patch Batch · thorsten · 2026-05-15 · 13 CVEs total
| CVE-2026-46364 | 9.8 CRITICAL | phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha |
| CVE-2026-45010 | 9.1 CRITICAL | phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint |
| CVE-2026-46367 | 7.6 HIGH | phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering |
| CVE-2026-46359 | 7.5 HIGH | phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields |
| CVE-2026-46366 | 7.5 HIGH | phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypas |
| CVE-2026-46361 | 6.9 MEDIUM | phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig |
| CVE-2026-45008 | 6.5 MEDIUM | phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter |
| CVE-2026-46362 | 6.5 MEDIUM | phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check |
| CVE-2026-46360 | 5.4 MEDIUM | phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer |
| CVE-2026-46363 | 5.4 MEDIUM | phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass |
| CVE-2026-45007 | 4.3 MEDIUM | phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information D |
| CVE-2026-45009 | 4.3 MEDIUM | phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints |
IV. Related Vulnerabilities
Same product: phpmyfaq
- CVE-2026-57995
phpMyFAQ - Privilege Escalation via Missing Self-Rights Cons - CVE-2026-56396
phpMyFAQ - Privilege Escalation via Missing Authorization in - CVE-2026-49205
phpMyFAQ: Missing userHasPermission() in 4 API write endpoin - CVE-2026-48488
phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing - CVE-2026-35676
phpMyFAQ - Unauthenticated Password Reset via User Password
Same vendor: thorsten
- CVE-2026-49205
phpMyFAQ: Missing userHasPermission() in 4 API write endpoin - CVE-2026-48488
phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing - CVE-2026-35676
phpMyFAQ - Unauthenticated Password Reset via User Password - CVE-2026-35675
phpMyFAQ - Authentication Bypass via Missing Password Reset - CVE-2026-35672
phpMyFAQ - Authentication Bypass via Empty API Token
Same weakness: CWE-862
- CVE-2026-14245
miniOrange OTP Login, Verification and SMS Notifications <= - CVE-2026-8848
Popup Maker – Boost Sales, Conversions, Optins, Subscribers - CVE-2026-11359
Memberships and User Profiles for WooCommerce <= 3.4 - Missi - CVE-2026-12406
User Frontend <= 4.3.7 - Missing Authorization to Unauthenti - CVE-2026-8996
Backup and Staging by WP Time Capsule <= 1.22.26 - Missing A
V. Comments for CVE-2026-46365
No comments yet