---
id: CVE-2026-108904
title: >-
  pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information
  disclosure vulnerability that allows API clients to obtain sensitive member
  data because UserController::users() and user() return unfiltered database
  rows
summary: >-
  pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information
  disclosure vulnerability that allows API clients to obtain sensitive member
  data because UserController::users() and user() return unfiltered database
  rows. Attacke…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-522
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T15:16:56.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108904'
references:
  - url: 'https://github.com/pH7Software/pH7-Social-Dating-CMS'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/modules/api/controllers/UserController.php#L161-L206
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/52a59da534c7666f7607c8a9b8c42037eb4de66d
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-sensitive-data-exposure-via-member-api-usercontroller
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.064Z'
---

## Overview

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password hashes, non-expiring hashValidation reset tokens, and TOTP secrets to take over accounts and bypass two-factor authentication.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.