Read the docs
TI-2026-34276 Aliases CVE-2026-46620

e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()

Priority MEDIUM 62CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass, Tampering
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285 and CWE-352.

Summary

e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how session_handler::check() handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates the token if one happens to be present. If there is no token at all, the check is skipped entirely. This vulnerability is fixed in 2.3.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00133 2nd percentileScored 2026-11-07
Fix Fixed e107 (e107inc): 2.3.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
e107ince107before 2.3.52.3.5Patch availableCNA
  • e107 Vendore107inc Affected before 2.3.5 Fixed in 2.3.5 Patch available CNA

Remediation

  • Fix · CNA e107 (e107inc) Fixed in 2.3.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46620

References

Other 1

  • TI-2026-74376 Unsafe deserialization in e107 installer enables remote code execution CVSS 3.1CRITICAL 9.8
  • TI-2026-31992 e107: Host Header Injection in e107 password reset enables phishing CVSS 3.1HIGH 8.1
  • TI-2026-41663 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize() CVSS 4.0HIGH 7.7
  • TI-2026-36251 e107: Command Injection via shell expansion in ImageMagick resize destination path CVSS 3.1HIGH 7.1
  • TI-2026-31991 e107: Broken Access Control in e107 comment edit allows cross-user comment modification CVSS 3.1MEDIUM 6.5
  • TI-2026-31993 e107: Server-Side Request Forgery (SSRF) in the remote file fetcher CVSS 3.1MEDIUM 4.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences