What is the CVSS score of CVE-2026-43934?

CVE-2026-43934 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-43934?

Yes, a patch is available for CVE-2026-43934. Update the affected software to the latest version immediately.

e107 CMS CVE-2026-43934

EUVD-2026-31849 MEDIUM

Improper Access Control (CWE-284)

2026-05-26 GitHub_M

Authentication Bypass E107

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 12:23 vuln.today

Analysis Generated

Jun 08, 2026 - 12:23 vuln.today

Patch available

May 26, 2026 - 17:02 EUVD

DescriptionCVE.org

e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment. This vulnerability is fixed in 2.3.4.

AnalysisAI

Broken access control in e107 CMS prior to version 2.3.4 permits any low-privileged authenticated user to overwrite comments authored by other users, including administrators. The server-side updateComment() function in comment_class.php accepted a comment_id from the request and issued an UPDATE SQL query filtered only by that identifier, never verifying that the requesting user owned the targeted comment. A proof-of-concept exploit exists per SSVC data, though EPSS stands at a low 0.03% (8th percentile) and no active exploitation is confirmed in CISA KEV, indicating currently limited in-the-wild activity.

Technical ContextAI

e107 is an open-source PHP-based CMS (CPE: cpe:2.3:a:e107inc:e107). The vulnerability resides in the updateComment() method of e107_handlers/comment_class.php. Prior to the fix, the SQL UPDATE statement was constructed as: WHERE comment_id = intval($id) - a server-side check that only validated the comment identifier, which is a predictable sequential integer. CWE-284 (Improper Access Control) accurately describes the root cause: the application relied entirely on the user-supplied comment_id to scope the write operation, with no server-side ownership verification binding that ID to the authenticated session's USERID. The patch (commit 23961a8f) adds AND comment_author_id = (int) USERID to the WHERE clause, enforcing ownership at the database query level. No client-side control or predictability-based defense was used as a substitute.

RemediationAI

Upgrade e107 to version 2.3.4 or later, which applies the server-side ownership check introduced in commit 23961a8f (https://github.com/e107inc/e107/commit/23961a8f). The vendor security advisory is available at https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6. If an immediate upgrade is not feasible, the most effective compensating control is to disable the public comment editing feature entirely in the e107 admin panel, accepting the trade-off that legitimate users also lose the ability to edit their own comments. Alternatively, restricting the edit-comment endpoint via web application firewall rules or role-based access policies to only allow administrator-tier accounts would reduce, but not fully eliminate, risk since it depends on how user roles are managed. Neither workaround substitutes for the patch, as the root fix must occur server-side in comment_class.php.