PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108905 ph7software CVE debrief

CVE-2026-108905 is a high-severity vulnerability in pH7Builder before version 18.6.0, allowing unauthenticated attackers to bypass API access checks by spoofing the Host header. This vulnerability affects pH7Builder installations and allows attackers to retrieve sensitive information. Defenders should assess exposure and prioritize upgrading to version 18.6.0 or later. The CVE record was published on 2026-10-11T14:58:06.784Z and has not been modified since then. The vulnerability is caused by a hard-coded API key in Tool.class.php.

Vendor
ph7software
Product
ph7builder
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-11
Original CVE updated
2026-10-11
Advisory published
2026-10-11
Advisory updated
2026-10-11

Who should care

Defenders responsible for pH7Builder installations should assess exposure and prioritize upgrading to version 18.6.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams. They should verify pH7Builder installations for exposure, monitor API access for suspicious activity, and review compensating controls for exposed systems. Additionally, they should track exceptions, retest remediated assets, and  

Why it matters

CVE-2026-108905 is a high-severity vulnerability in pH7Builder before version 18.6.0, allowing unauthenticated attackers to bypass API access checks by spoofing the Host header. Defenders responsible for pH7Builder installations should assess exposure and prioritize upgrading to version 18.6.0 or later.

  • Verify pH7Builder installations for exposure to ensure API access integrity
  • Upgrade to pH7Builder version 18.6.0 or later to prevent API key bypass
  • Monitor API access for suspicious activity to detect potential attacks

Technical summary

pH7Builder before version 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. The vulnerability allows attackers to retrieve member emails, IP addresses, phone numbers, and bank account fields. Defenders should prioritize verifying exposure of pH7Builder installations and upgrading to version 18.6.0 or later. The vulnerability is caused by a hard-coded API key in Tool.class.php, which can be exploited by sending a Host: localhost header with private_api_key=dev772277.

Defensive priority

Defenders should prioritize verifying exposure of pH7Builder installations and upgrading to version 18.6.0 or later.

Recommended defensive actions

  • Verify pH7Builder installations for exposure
  • Upgrade to pH7Builder version 18.6.0 or later
  • Monitor API access for suspicious activity
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the hard-coded API key vulnerability in pH7Builder before version 18.6.0. The vulnerability allows unauthenticated attackers to bypass API access checks by spoofing the Host header.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108905 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108905

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108905 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108905

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108905.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/cfe1e0c418946b868db8c399d0cf6b122552efd2

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.5.1/_protected/framework/Api/Tool.class.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/pH7Software/pH7-Social-Dating-CMS

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/ph7builder-before-18.6.0-hard-coded-api-key-bypass-via-host-header

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.