CVE-2026-43934
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment.
Risk Assessment
The risk involves the possibility of modifying other users' comments, which could lead to content manipulation, disinformation, or data integrity violations.
Recommendation
It is recommended to immediately upgrade e107 to version 2.3.4 or later, which includes a fix for this vulnerability.
Other vulnerabilities in e107
See all- CVE-2026-57859High
e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler. An attacker with database write access can store a crafted payload in the user_prefs column, which upon materialization of user preferences is passed to eval(), leading to automatic execution of arbitrary PHP code.
- CVE-2016-10378High
e107 version 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.php, related to the menuSaveVisibility function.
- CVE-2026-72599Critical
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause.
- CVE-2026-43936Medium
e107 CMS prior to version 2.3.4 allows access to the local environment by specifying a local URL in the "Image/File URL:" field of the "From a remote location" option in the Media Manager on the admin screen. This vulnerability is fixed in version 2.3.4.
- CVE-2026-43935High
In e107 before 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to generate password reset links pointing to attacker-controlled domains.
Original NVD description (English source)
e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment. This vulnerability is fixed in 2.3.4.