What is the CVSS score of CVE-2026-46620?

CVE-2026-46620 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-46620?

Yes, a patch is available for CVE-2026-46620. Update the affected software to the latest version immediately.

e107 CMS CVE-2026-46620

EUVD-2026-31851 MEDIUM

Improper Authorization (CWE-285)

2026-05-26 GitHub_M

CSRF Authentication Bypass E107

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:16 vuln.today

Patch available

May 26, 2026 - 17:02 EUVD

DescriptionCVE.org

e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how session_handler::check() handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates the token if one happens to be present. If there is no token at all, the check is skipped entirely. This vulnerability is fixed in 2.3.5.

AnalysisAI

CSRF protection bypass in e107 CMS prior to 2.3.5 allows unauthenticated remote attackers to perform unauthorized comment moderation actions by tricking an authenticated user into visiting a malicious page. The root flaw is in session_handler::check(), which skips CSRF token validation entirely when no token is submitted, rather than rejecting the tokenless request - effectively making CSRF protection opt-in from the attacker's perspective. A proof-of-concept exists per SSVC data; the vulnerability is not listed in CISA KEV and carries a very low EPSS score of 0.01% (3rd percentile), indicating limited observed exploitation in the wild.

Technical ContextAI

e107 is an open-source PHP content management system (cpe:2.3:a:e107inc:e107:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-285 (Improper Authorization), reflecting that the access control decision on state-changing comment moderation endpoints does not reliably enforce identity verification. The CSRF token mechanism in session_handler::check() is conditionally evaluated: it validates a token only if one is present in the request. An attacker-crafted request that omits the token entirely bypasses this check, as the absence of a token is treated as equivalent to a valid token rather than as an error. This is a well-known anti-pattern in CSRF defense implementations and represents a logical control gap rather than a memory corruption or injection flaw.

RemediationAI

Upgrade to e107 version 2.3.5, which contains the vendor-released fix for this vulnerability as confirmed by the GitHub advisory GHSA-m4hh-m278-jwg5. If an immediate upgrade is not possible, a compensating control is to restrict access to comment moderation endpoints at the application or web server layer (e.g., require VPN or IP allowlist for admin paths), which reduces the attack surface for CSRF by limiting who can reach the vulnerable endpoints - trade-off is operational friction for legitimate moderators. Additionally, ensuring the SameSite=Strict or SameSite=Lax cookie attribute is set on session cookies can mitigate CSRF in modern browsers, though this is a browser-enforced control and not a substitute for server-side token enforcement.