CVE-2026-107637
pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action
ph7software ph7builder
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 18.5.0ph7builderCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.
Text from CVE List
Affected versions 2
- ph7builderaffected: all versions before 18.5.0CVE List
- ph7builderunaffected: 18.5.0CVE List
References 4
- github.com/pH7Software/pH7-Social-Dating-CMS/commit/e784139b2385ef44d08a1d586c365857dd777ef6Fixvia CVE List
- vulncheck.com/advisories/ph7builder-before-18.5.0-improper-authorization-via-note-module-delete-actionAdvisoryvia CVE List
- github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/modules/note/controllers/MainController.php#L311-L320Referencevia CVE List
- github.com/pH7Software/pH7-Social-Dating-CMSReferencevia CVE List