medium6.5
CVE-2026-43934
e107 is a content management system (CMS).
Impact
e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment. This vulnerability is fixed in 2.3.4.
Affected products
| Product | Affected versions |
|---|---|
| E107 Is A Content Management System (CMS). | before 2.3.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.