CVE-2026-107637 Details
Description
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.
An improper authorization vulnerability has been identified in pH7Builder (pH7 Social Dating CMS) versions prior to 18.5.0. The issue resides in the note module's delete() action, where authenticated users can delete comments and category associations of other users' notes. This vulnerability arises because the deletion queries do not verify the profile ID, allowing attackers to manipulate the POST id parameter with another member's note ID to remove associated comments and categories.
Users can upgrade to pH7Builder version 18.5.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pH7Builder | >= 0, < 18.5.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | New CVE Received | [email protected] |
| Oct 8, 2026 | CVE Modified | CISA-ADP |