Vulnerability · Published May 26, 2026 · Assigned by GitHub_M

CVE-2026-46620e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()

Medium 6.5

In plain English

A medium-severity cross-site request forgery in e107 from e107inc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.1%top 97.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how session_handler::check() handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates the token if one happens to be present. If there is no token at all, the check is skipped entirely. This vulnerability is fixed in 2.3.5.

Affected products (as reported)

Vendor	Product	Versions
e107inc	e107	< 2.3.5

Weakness: CWE-285, CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

https://github.com/e107inc/e107/security/advisories/GHSA-m4hh-m278-jwg5 x_refsource_CONFIRM