GHSA-7cx3-2qx2-3g6w: phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags

The TagController::delete() endpoint at DELETE /admin/api/content/tags/{tagId} only verifies that the user is logged in (userIsAuthenticated()), but does not check any permission. Any authenticated user — including regular non-admin frontend users — can delete any tag by ID. This contrasts with TagController::update() and TagController::search(), which both enforce the FAQ_EDIT permission.