CVE-2026-43934 — e107: Broken Access Control in e107 comment edit allows cross-user comment modification
e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit c…
Published: 2026-05-26 · CVSS: 6.5 · CVSS 3.1
e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment. This vulnerability is fixed in 2.3.4.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7