Read the docs
TI-2026-31991 Aliases CVE-2026-43934

e107: Broken Access Control in e107 comment edit allows cross-user comment modification

Priority MEDIUM 62CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment. This vulnerability is fixed in 2.3.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00181 7th percentileScored 2026-11-07
Fix Fixed e107 (e107inc): 2.3.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
e107ince107before 2.3.42.3.4Patch availableCNA
  • e107 Vendore107inc Affected before 2.3.4 Fixed in 2.3.4 Patch available CNA

Remediation

  • Fix · CNA e107 (e107inc) Fixed in 2.3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43934

References

Other 2

  • TI-2026-74376 Unsafe deserialization in e107 installer enables remote code execution CVSS 3.1CRITICAL 9.8
  • TI-2026-31992 e107: Host Header Injection in e107 password reset enables phishing CVSS 3.1HIGH 8.1
  • TI-2026-41663 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize() CVSS 4.0HIGH 7.7
  • TI-2026-36251 e107: Command Injection via shell expansion in ImageMagick resize destination path CVSS 3.1HIGH 7.1
  • TI-2026-34276 e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check() CVSS 3.1MEDIUM 6.5
  • TI-2026-31993 e107: Server-Side Request Forgery (SSRF) in the remote file fetcher CVSS 3.1MEDIUM 4.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences