Medium
pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action
Type: advisorySources: OSV
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-107637
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 04:15 UTC · Revision 1
Source evidence
pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action
core-osv · Original sourcePublished 8 Oct 2026, 14:10 UTC
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.
osv:CVE-2026-107637
Complete source record
{
"id": "92c56a07e704f20cc4c41a07bc68bf1bf9ed08adb8d951c4299330e166594baf",
"url": "https://osv.dev/vulnerability/CVE-2026-107637",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action",
"summary": "pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.",
"evidence": "osv:CVE-2026-107637",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-107637",
"aliases": [
"CVE-2026-107637"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ph7software/ph7-social-dating-cms",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "4362cb3576f7443e8d3516347f5c3caaf3943291"
},
{
"fixed": "e784139b2385ef44d08a1d586c365857dd777ef6"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "18.5.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "e784139b2385ef44d08a1d586c365857dd777ef6"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v18.4.1",
"v18.4.0",
"v18.3.0",
"v18.2.0",
"v18.1.0",
"v17.9.2",
"17.9.2-beta.2",
"17.9.2-beta.1",
"v17.9.1-beta.1",
"v17.9.1",
"v17.9.0",
"18.0.0-beta.2",
"18.0.0-beta.1",
"17.2.0",
"17.2.0-rc.2",
"17.2.0-rc.1",
"17.2.0-beta.1",
"17.1.8",
"17.1.8.beta.2",
"17.1.8.beta.1",
"17.1.2",
"17.1.0",
"17.0.1",
"17.0.0",
"v17.0.0",
"17.0.0-beta.3",
"v17.0.0-beta.2",
"17.0.0-beta.2",
"16.5.0.beta.1",
"16.3.2",
"16.3.0-beta.1",
"16.3.0",
"16.2.2",
"16.2.0-beta.1",
"16.2.0",
"16.1.0",
"16.1.0-beta.1",
"16.0.2-beta.1",
"16.0.0",
"16.0.0-rc.3",
"16.0.0-rc.2",
"16.0.0-rc.1",
"16.0.0-beta.2",
"16.0.0-beta.1",
"15.4.0",
"15.4.0-beta.2",
"15.4.0-beta.1",
"15.3.0",
"15.3.0-rc.3",
"15.3.0-rc.1",
"15.2.0",
"15.1.8",
"15.1.7",
"15.1.6",
"15.1.0",
"15.1.0-rc2",
"15.1.0-rc",
"15.1.0-beta",
"15.0.0",
"15.0.0-rc",
"15.0.0-beta2",
"15.0.0-beta1",
"14.9.0",
"14.9.0-rc2",
"14.9.0-rc",
"14.8.9",
"14.8.8",
"14.8.8-rc2",
"14.8.8-rc",
"14.8.0",
"14.7.0",
"14.3.6",
"14.3.4-rc",
"14.3.0",
"14.0.0",
"14.0.0-rc3",
"14.0.0-rc2",
"14.0.0-rc",
"12.9.9",
"12.9.8",
"untagged-de05a9b7f66bb64ad418",
"12.9.0",
"12.6.1",
"12.6.5",
"12.5.9",
"12.3.5",
"12.6.0",
"12.3.0",
"12.1.2",
"12.1.0",
"12.0.0",
"10.2.0",
"10.0.8",
"8.0.6",
"8.0.4",
"8.0.3",
"8.0.2",
"7.1.3",
"7.0.01",
"7.0.0",
"6.0.13",
"6.0.9",
"6.0.1",
"6.0.0",
"5.0.0",
"4.0.0",
"3.1.0",
"3.0.0",
"2.0.9",
"2.0.4",
"1.4.2",
"1.4.1",
"1.4.0",
"1.3.9",
"1.3.8",
"1.3.7",
"1.3.6",
"1.3.5",
"1.3.0",
"1.2.9",
"1.2.8",
"1.2.7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107637.json"
}
}
],
"modified": "2026-10-28T02:30:25.680082014Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107637.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-107637",
"https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-improper-authorization-via-note-module-delete-action",
"https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/e784139b2385ef44d08a1d586c365857dd777ef6",
"https://github.com/pH7Software/pH7-Social-Dating-CMS",
"https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/modules/note/controllers/MainController.php#L311-L320"
],
"provider_metadata": {
"cwe_ids": [
"CWE-639"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107637.json"
}
},
"related_cves": [
{
"value": "CVE-2026-107637",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 492420,
"published_at": "2026-10-08T14:10:34.824+00:00"
}