GHSA-7cx3-2qx2-3g6w: phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags

May 6, 2026

The TagController::delete() endpoint at DELETE /admin/api/content/tags/{tagId} only verifies that the user is logged in (userIsAuthenticated()), but does not check any permission. Any authenticated user — including regular non-admin frontend users — can delete any tag by ID. This contrasts with TagController::update() and TagController::search(), which both enforce the FAQ_EDIT permission.

References

github.com/advisories/GHSA-7cx3-2qx2-3g6w
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7cx3-2qx2-3g6w

Code Behaviors & Features

Detect and mitigate GHSA-7cx3-2qx2-3g6w with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →