CVE-2026-8747 Details
Description
A weakness has been identified in Z-BlogPHP 1.7.4.3430. This affects the function CheckComment of the file zb_system/function/c_system_event.php of the component Commend Approval Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
An authorization vulnerability has been identified in Z-BlogPHP version 1.7.4.3430, specifically within the comment approval handling function. This weakness allows low-privilege users with the 'commenter' role to approve their own pending comments without administrator oversight. The issue arises because the application improperly authorizes comment moderation actions, enabling users to bypass established moderation workflows. The vulnerability can be exploited remotely, and public proof-of-concept exploits are available.
To address this vulnerability, remove the authorization checks in the 'CheckComment()' and 'BatchComment()' functions that allow comment authors to modify their comments' moderation status. Restrict comment approval to users with 'CommentAll' permission or other designated moderation roles. Additionally, adjust the 'Admin_CommentMng()' function to prevent low-privilege commenters from accessing moderation tools for their own comments.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 17, 2026CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/810027 | [email protected] | Permission Required |
| https://vuldb.com/vuln/364334 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/364334/cti | [email protected] | AdvisoryPermission Required |
| https://vulnplus-note.wetolink.com/share/31wtzNoJbxKQ | [email protected] | ExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Z-BlogPHP | 1.7.4.3430 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 17, 2026 | New CVE Received | [email protected] |