CVE-2026-46620
e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how session_handler::check() handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates the token if one happens to be present. If there is no token at all, the check is skipped entirely. This vulnerability is fixed in 2.3.5.
| CWE | CWE-285 CWE-352 |
| Vendor | e107inc |
| Product | e107 |
| Published | May 26, 2026 |
| Last Updated | May 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for e107inc e107
Be the first to know when new medium vulnerabilities affecting e107inc e107 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
e107inc / e107
< 2.3.5