CVE-2026-43934: e107: Broken Access Control in e107 comment edit allows cross-user comment modification
e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment. This vulnerability is fixed in 2.3.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
e107to a version that resolves this vulnerability.Fixed in 2.3.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43934?
The severity of CVE-2026-43934 is medium with a score of 6.5.
How do I fix CVE-2026-43934?
To fix CVE-2026-43934, upgrade the e107 application to version 2.3.4 or later.
What kind of access does CVE-2026-43934 allow?
CVE-2026-43934 allows unauthorized authenticated users to edit comments posted by other users.
What is the cause of CVE-2026-43934?
CVE-2026-43934 is caused by inadequate server-side access control validation in the e107 CMS.
Which software is affected by CVE-2026-43934?
CVE-2026-43934 affects the e107 content management system prior to version 2.3.4.