Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-107637pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in ph7builder from ph7software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 84.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.

Affected products (as reported)

Vendor	Product	Versions
ph7software	ph7builder	0 – before 18.5.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Patch Commit patch
https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/modules/note/controllers/MainController.php#L311-L320 technical-description
https://github.com/pH7Software/pH7-Social-Dating-CMS product
VulnCheck Advisory: pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action third-party-advisory