PT-2026-43266 · E107 · E107

Longnv719 · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-43934

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions e107 versions prior to 2.3.4

Description e107 is a content management system (CMS) containing a broken access control issue. An authenticated user can edit comments posted by other users due to inadequate server-side access control validation. The application relies solely on a predictable identifier in the request to determine the comment to be edited, failing to verify if the requesting user owns the comment.

Recommendations Update to version 2.3.4.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2026-43934

Affected Products

E107

References · 4

• 🔥 https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43934 · Security Note
• https://github.com/e107inc/e107/commit/23961a8f · Note
• https://t.me/CVEtracker/54981 · Telegram Post