CVE-2026-43934

6.5 Moyenne

Publiée le 26/05/2026 à 18:16 · Modifiée le 24/07/2026 à 13:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment. This vulnerability is fixed in 2.3.4.

Traduire en français

Produits concernés

e107inc e107

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-284
CWE-639

Références

https://github.com/e107inc/e107/commit/23961a8f
https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6
https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories