CVE-2026-46620: e107 CMS CSRF Vulnerability

CVE-2026-46620 Overview

CVE-2026-46620 is a Cross-Site Request Forgery (CSRF) vulnerability in e107, an open-source content management system (CMS). Versions prior to 2.3.5 fail to enforce CSRF token validation on comment moderation actions. The flaw resides in the session_handler::check() function, which validates a token only when one is present in the request. When no token is supplied, the check is silently skipped, allowing state-changing requests without authorization verification. The vulnerability is tracked under [CWE-285] (Improper Authorization) and is fixed in e107 version 2.3.5.

Critical Impact
An attacker who tricks an authenticated moderator or administrator into visiting a crafted page can issue comment moderation actions on their behalf, compromising the integrity of site content.

Affected Products

e107 CMS versions prior to 2.3.5
e107 comment moderation subsystem (session_handler::check())
Deployments exposing administrative moderation endpoints to authenticated users

Discovery Timeline

2026-05-26 - CVE-2026-46620 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46620

Vulnerability Analysis

The vulnerability stems from incorrect CSRF enforcement logic in e107's session handling layer. The session_handler::check() function inspects incoming requests for a CSRF token and validates it only when one is provided. Requests that omit the token entirely bypass validation, because the absence of a token is treated as a non-event rather than a failure condition. This converts what should be a mandatory security control into an optional one.

Comment moderation actions, such as approving, rejecting, or deleting user comments, qualify as state-changing operations and must require a valid CSRF token per OWASP guidance. Because the check is conditional, an attacker can craft a malicious HTML page that issues forged requests to moderation endpoints. If a logged-in moderator visits the page, the browser automatically attaches session cookies and the action succeeds.

The issue is categorized under [CWE-285] (Improper Authorization). Confidentiality is not directly impacted, but integrity of the comment system is fully exposed. Exploitation requires user interaction, typically through phishing or a malicious link, and no privileges on the attacker side.

Root Cause

The root cause is a fail-open logic pattern in session_handler::check(). The function should reject any state-changing request lacking a valid CSRF token. Instead, it only enforces validation when a token is present, allowing token-less requests to proceed unchecked.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts or injects a page containing an auto-submitting form or image tag that targets an e107 moderation endpoint. When an authenticated moderator loads the page, the browser sends the request with their session cookies, and the server processes the moderation action without verifying intent.

The vulnerability mechanism is described in detail in the upstream GitHub Security Advisory GHSA-m4hh-m278-jwg5.

Detection Methods for CVE-2026-46620

Indicators of Compromise

Unexpected comment approval, rejection, or deletion events in the e107 audit log attributed to moderator accounts
HTTP POST requests to comment moderation endpoints lacking a CSRF token parameter
Referer headers on moderation requests pointing to external or unrelated domains

Detection Strategies

Inspect web server access logs for POST requests to e107 moderation handlers without the expected CSRF token field
Correlate moderation actions with the originating Referer and User-Agent to identify off-domain triggers
Review e107 administrative activity logs for moderation patterns inconsistent with a moderator's normal workflow

Monitoring Recommendations

Enable verbose logging on the e107 admin and moderation interfaces to capture request metadata
Alert on bulk moderation actions performed in short time windows from a single session
Monitor outbound links and embedded content posted by untrusted users for potential CSRF payloads targeting administrators

How to Mitigate CVE-2026-46620

Immediate Actions Required

Upgrade e107 CMS to version 2.3.5 or later, which enforces CSRF token validation on all state-changing requests
Audit recent comment moderation activity for unauthorized approvals or deletions performed during the exposure window
Require moderators to log out of e107 administrative sessions when not actively in use

Patch Information

The vulnerability is fixed in e107 version 2.3.5. The patch updates session_handler::check() so that missing CSRF tokens on state-changing requests result in rejection rather than a silent pass. Patch details are available in the e107 GitHub Security Advisory.

Workarounds

Restrict access to the e107 administrative interface to trusted IP ranges using web server or firewall rules
Deploy a web application firewall rule that rejects POST requests to moderation endpoints lacking a CSRF token parameter
Enforce SameSite=Strict cookies on the e107 session cookie to block cross-site request inclusion in modern browsers

bash

# Example nginx rule to block moderation POSTs without a CSRF token parameter
location ~* /e107_admin/comment\.php$ {
    if ($request_method = POST) {
        if ($args !~ "e-token=") {
            return 403;
        }
    }
}