Vulnerability · Published May 26, 2026 · Assigned by GitHub_M

CVE-2026-43934e107: Broken Access Control in e107 comment edit allows cross-user comment modification

Medium 6.5

In plain English

A medium-severity improper access control in e107 from e107inc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 92.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment. This vulnerability is fixed in 2.3.4.

Affected products (as reported)

Vendor	Product	Versions
e107inc	e107	< 2.3.4

Weakness: CWE-284, CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6 x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/23961a8f x_refsource_MISC