CVE-2026-43934

MEDIUM

e107: Broken Access Control in e107 comment edit allows cross-user comment modification

Title source: cna
STIX 2.1

Description

e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment. This vulnerability is fixed in 2.3.4.

References (2)

Core 2

Scores

CVSS v3 6.5
EPSS 0.0018
EPSS Percentile 7.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-284 CWE-639
Status published
Products (1)
e107inc/e107 < 2.3.4
Published May 26, 2026
Tracked Since May 26, 2026