IND-CCA insecurity of modified CBC encrypt + MAC scheme
One security issue that comes to mind is that the tag of a message in this scheme relies only on the last block of ciphertext, not the rest of the message.

So, what would happen if the adversary took a valid $⟨c, \tau⟩$ pair and modified $c$ by repeating the last block, that is, converting it into the pair $⟨c || c^*, \tau⟩$ and forwarding that to the decryptor?
Would the modified ciphertext pass the integrity check?
Bonus question (to make the attack even worse): if it did, what would the resulting plaintext look like?