# CVE-2026-43934: e107 CMS broken access control in comment editing

Source: https://junglewise.ai/threats/cve-2026-43934-e107-cms-broken-access-control-in-comment-editing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-43934 · Severity: medium · CVSS 6.5 · Published 2026-05-26

e107 is a content management system used to build and manage websites. A security flaw allows any logged-in user to modify or overwrite comments posted by other users. This could lead to the spread of misinformation, harassment, or damage to the website's reputation as user-contributed content can no longer be trusted as authentic.

Technologies: [E107inc E107](https://junglewise.ai/threats/technologies/e107). Vendors: [E107inc](https://junglewise.ai/threats/vendors/e107inc).

## Quick answers

**Is CVE-2026-43934 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43934 being exploited in the wild.

**How severe is CVE-2026-43934?** Medium severity, with a CVSS score of 6.5, published 26 May 2026.

**Which products and versions are affected?** E107inc E107 < 2.3.4.

**Is there a fix for CVE-2026-43934?** A patch was published on 2026-05-26: Fix released in version 2.3.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43934 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-43934?** Check whether you run E107inc E107 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability (Insecure Direct Object Reference) exists in e107 CMS prior to version 2.3.4. The application's comment editing logic in `comment.php` and the `updateComment` function in `comment_class.php` failed to verify if the requesting user was the original author of the comment. An attacker with a low-privileged account can exploit this by sending a POST request to `comment.php?mode=edit` with a manipulated `itemid` parameter. Because the server-side SQL query originally only filtered by `comment_id` without checking `comment_author_id`, the attacker can successfully overwrite any comment in the database. This issue is resolved in version 2.3.4 by adding an ownership check to the database update query.

## Affected products

- e107inc e107 < 2.3.4

## Timeline

- 2026-05-05: advisory: GitHub Security Advisory published by the vendor
- 2026-05-26: disclosed: CVE published to the NVD
- 2026-05-26: patched: Fix released in version 2.3.4

## References

- [https://github.com/e107inc/e107/commit/23961a8f](https://github.com/e107inc/e107/commit/23961a8f)
- [https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6](https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6)

## Related threats

- [e107 CMS reflected XSS in search author parameter](https://junglewise.ai/threats/cve-2026-114407-e107-cms-before-2-3-13-contains-a-reflected-cross-site-scripting)
- [e107 SQL injection in alt_auth authentication backends](https://junglewise.ai/threats/cve-2026-55572-e107-is-a-content-management-system-cms-prior-to-2-3-7-the)
- [e107 CMS remote code execution in e_array deserialization](https://junglewise.ai/threats/cve-2026-57859-e107-cms-remote-code-execution-in-e-array-deserialization)
- [e107 CMS command injection in ImageMagick resize destination path](https://junglewise.ai/threats/cve-2026-48997-e107-cms-command-injection-in-imagemagick-resize-destination-path)
- [e107 CMS CSRF in comment moderation endpoints](https://junglewise.ai/threats/cve-2026-46620-e107-cms-csrf-in-comment-moderation-endpoints)