---
id: CVE-2026-107637
title: >-
  pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper
  authorization vulnerability in the note module delete() action that allows
  authenticated members to delete other members' note comments and categories
summary: >-
  pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper
  authorization vulnerability in the note module delete() action that allows
  authenticated members to delete other members' note comments and categories.
  Attackers can s…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-639
vendor: ph7software
product: ph7builder
affected:
  - ph7builder < 18.5.0
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T15:17:46.873'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107637'
references:
  - url: 'https://github.com/pH7Software/pH7-Social-Dating-CMS'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/modules/note/controllers/MainController.php#L311-L320
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/e784139b2385ef44d08a1d586c365857dd777ef6
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-improper-authorization-via-note-module-delete-action
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T14:47:39.593788Z'
ingestedAt: '2026-10-08T14:47:16.357Z'
---

## Overview

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.