Broken Access Control Vulnerability in e107 CMS
CVE-2026-43934

6.5MEDIUM

Key Information:

Vendor

E107inc

Status
E107
Vendor
CVE Published:
26 May 2026

What is CVE-2026-43934?

The e107 CMS prior to version 2.3.4 contains a broken access control vulnerability that allows an unauthorized authenticated user to edit comments made by others. This issue arises from inadequate server-side access control validation. The application relies solely on a predictable identifier in the request to determine which comment to edit, failing to verify if the requesting user owns the comment. Users are strongly advised to upgrade to version 2.3.4 to mitigate this risk.

Affected Version(s)

e107 < 2.3.4

References

https://github.com/e107inc/e107/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/23961a8f
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.