CVE-2026-46620: e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()
e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how sessionhandler::check() handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates the token if one happens to be present. If there is no token at all, the check is skipped entirely. This vulnerability is fixed in 2.3.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
e107 CMSto a version that resolves this vulnerability.Fixed in 2.3.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46620?
CVE-2026-46620 has a medium severity rating of 6.5.
What kind of vulnerability is CVE-2026-46620?
CVE-2026-46620 is a Cross-Site Request Forgery (CSRF) vulnerability in the e107 CMS.
How do I fix CVE-2026-46620?
To fix CVE-2026-46620, upgrade to e107 version 2.3.5 or later which enforces CSRF token validation.
What actions are affected by CVE-2026-46620?
CVE-2026-46620 affects comment moderation actions that lack proper CSRF token validation.
Who is impacted by CVE-2026-46620?
Users of e107 CMS versions prior to 2.3.5 are impacted by CVE-2026-46620 due to the lack of CSRF protection.