CVE-2026-43934CWE-284CWE-639

e107: Broken Access Control in e107 comment edit allows cross-user comment modification

Medium · published May 26, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment. This vulnerability is fixed in 2.3.4.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.8th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-26T14:54Z
EPSS history
Timeline
  • 26 MAY 14:54Z
    e107: Broken Access Control in e107 comment edit allows cross-user comment modification
    cvelistv5