CVE-2026-46620

Description

e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how session_handler::check() handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates the token if one happens to be present. If there is no token at all, the check is skipped entirely. This vulnerability is fixed in 2.3.5.

PUBLISHED Reserved 2026-05-15 | Published 2026-05-26 | Updated 2026-05-27 | Assigner GitHub_M

Problem types

CWE-285: Improper Authorization

CWE-352: Cross-Site Request Forgery (CSRF)

Product status

References

github.com/...c/e107/security/advisories/GHSA-m4hh-m278-jwg5 exploit

github.com/...c/e107/security/advisories/GHSA-m4hh-m278-jwg5

cve.org (CVE-2026-46620)

nvd.nist.gov (CVE-2026-46620)

Download JSON