Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108904pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController

Medium 6.5

In plain English

A medium-severity security flaw in ph7builder from ph7software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password hashes, non-expiring hashValidation reset tokens, and TOTP secrets to take over accounts and bypass two-factor authentication.

Affected products (as reported)

Vendor	Product	Versions
ph7software	ph7builder	0 – before 18.5.0

Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Patch Commit patch
https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/modules/api/controllers/UserController.php#L161-L206 technical-description
https://github.com/pH7Software/pH7-Social-Dating-CMS product
VulnCheck Advisory: pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController third-party-advisory