Medium severity · published Oct 8, 2026
CVE-2026-107637
pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
ph7builder · ph7software
before 18.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107637
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107637
patch
https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/e784139b2385ef44d08a1d586c365857dd777ef6
technical-description
https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/modules/note/controllers/MainController.php#L311-L320
product
https://github.com/pH7Software/pH7-Social-Dating-CMS
third-party-advisory
https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-improper-authorization-via-note-module-delete-action
More from ph7builder
8.1
CVE-2026-108902
pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link
7.5
CVE-2026-108905
pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header
6.8
CVE-2026-107638
pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php
6.5
CVE-2026-108904
pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController
6.5
CVE-2026-107636
pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController