{"id":"CVE-2026-108905","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-108905","summary":"pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header","details":"pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.","published":"2026-10-11T14:58:06.784Z","modified":"2026-10-12T02:32:45.079531290Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/cfe1e0c418946b868db8c399d0cf6b122552efd2","label":"pH7Software/pH7-Social-Dating-CMS@cfe1e0c"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108905.json"},{"type":"PACKAGE","url":"https://github.com/pH7Software/pH7-Social-Dating-CMS"},{"type":"ARTICLE","url":"https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.5.1/_protected/framework/Api/Tool.class.php#L25-L48"},{"type":"FIX","url":"https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/cfe1e0c418946b868db8c399d0cf6b122552efd2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108905"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/ph7builder-before-18.6.0-hard-coded-api-key-bypass-via-host-header"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-12T02:32:45.079531290Z"}}