CVE-2026-108904

Deferred Deferred - Pending Action

pH7Builder API Information Disclosure Vulnerability

Publication date: 2026-10-11

Last updated on: 2026-10-13

Assigner: VulnCheck

Description

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password hashes, non-expiring hashValidation reset tokens, and TOTP secrets to take over accounts and bypass two-factor authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-11

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-11

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108904

EUVD

EUVD-2026-97067

Affected Vendors & Products

Vendor	Product	Version / Range
ph7software	ph7builder	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability is an information disclosure flaw in pH7Builder (pH7 Social Dating CMS) versions before 18.5.0. It allows API clients with a valid private API key to access sensitive member data through unfiltered database rows returned by UserController::users() and user(). Attackers can retrieve bcrypt password hashes, non-expiring reset tokens, and TOTP secrets, enabling account takeovers and bypassing two-factor authentication.

Detection Guidance

Check if your pH7Builder version is below 18.5.0 by running: grep -r 'version' /path/to/pH7Builder/_protected/app/system/config/ or check the admin panel. Test API endpoints for sensitive data exposure by sending requests with a valid private API key to /api/user/{id} or /api/users and inspect responses for bcrypt hashes, reset tokens, or TOTP secrets.

Impact Analysis

If you use pH7Builder before version 18.5.0, attackers with a valid API key could steal bcrypt password hashes, reset tokens, and TOTP secrets. This could lead to unauthorized account access, data breaches, and loss of sensitive member information. Immediate upgrade to version 18.5.0 or later is required to mitigate this risk.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive member data, including passwords and authentication tokens. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. The exposure of such data violates these regulations, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade pH7Builder to version 18.5.0 or later immediately. If upgrading is not possible, restrict access to the Member API by disabling private API keys or implementing IP-based access controls. Review logs for unauthorized API access attempts and rotate all exposed credentials, including passwords and TOTP secrets.

Hi! I’m here to help you understand CVE-2026-108904. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70