PT-2026-43269 · E107 · E107

Mrknight-N1Du · CVE-2026-46620 · Published 2026-05-26 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions e107 versions prior to 2.3.5

Description e107 is a content management system (CMS) that fails to properly enforce Cross-Site Request Forgery (CSRF) token validation on comment moderation actions. The issue occurs within the session handler::check() function, which only validates the CSRF token if it is present in the request. If the token is completely missing, the validation check is skipped, allowing state-changing requests to be processed without authentication. This affects the 'comment.php' moderation endpoints.

Recommendations Update to version 2.3.5.

Exploit

Fix

Improper Authorization

CSRF

Weakness Enumeration

CWE-285

CWE-352

Related Identifiers

CVE-2026-46620

GHSA-M4HH-M278-JWG5

Affected Products

E107

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46620.json · Exploit
• 🔥 https://github.com/e107inc/e107/security/advisories/GHSA-m4hh-m278-jwg5 · Exploit
• https://osv.dev/vulnerability/CVE-2026-46620 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46620 · Security Note
• https://t.me/CVEtracker/54983 · Telegram Post