What’s Vulnerable › Vulnerabilities

CVE-2026-107637: pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-08 · updated 2026-10-08
• Weakness: CWE-639

Description

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.

Affected products

• ph7software ph7builder: before 18.5.0 — fixed in 18.5.0

How to fix

Upgrade to a fixed version: ph7software ph7builder 18.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/pH7Software/pH7-Social-Dating-CMS
• https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/modules/note/controllers/MainController.php#L311-L320
• https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/e784139b2385ef44d08a1d586c365857dd777ef6
• https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-improper-authorization-via-note-module-delete-action

Get alerted when CVE-2026-107637 or the next vulnerability affects your stack