CVE-2026-108904 in pH7Builder
Summary
by MITRE • 10/11/2026
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password hashes, non-expiring hashValidation reset tokens, and TOTP secrets to take over accounts and bypass two-factor authentication.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in pH7Builder versions prior to 18.5.0 represents a critical information disclosure flaw within the application's API layer, specifically affecting the UserController methods for retrieving user data. The core technical deficiency lies in the lack of proper filtering or sanitization applied to database query results before they are serialized and returned to the client. When an authenticated API consumer invokes these endpoints, the system returns raw database rows without excluding sensitive fields that should remain internal to the application logic. This design oversight allows any actor possessing a valid private API key to extract data that is not intended for external consumption, fundamentally breaking the principle of least privilege by exposing high-sensitivity attributes through standard API responses.
The operational impact of this vulnerability is severe due to the specific types of credentials and secrets exposed in these unfiltered rows. Attackers can retrieve bcrypt password hashes directly from the database records. While bcrypt hashes are computationally expensive to crack, they provide a viable target for offline brute-force attacks if the hash strength was not configured with sufficient work factors. More critically, the vulnerability exposes non-expiring reset tokens used for hash validation and Time-based One-Time Password (TOTP) secrets required for two-factor authentication. The exposure of TOTP seeds allows an attacker to generate valid one-time codes indefinitely, effectively neutralizing multi-factor security controls. Similarly, access to non-expiring reset tokens enables persistent account takeover capabilities without the need for password cracking or phishing attacks against users.
From a classification perspective, this vulnerability aligns with CWE-209, which describes the generation of an error message that includes sensitive information about the environment, and more accurately CWE-538, regarding the inclusion of file or system path in error messages if it reveals internal state, though here it extends to general data exposure. It is also categorized under CWE-749, where a security-critical function is not called at an appropriate time, specifically failing to filter sensitive data before output. In terms of adversary tactics, this aligns with the MITRE ATT&CK technique T1087, Account Discovery, and potentially T1528, Steal Application Access Token, as it facilitates unauthorized access through compromised credentials or bypassed authentication mechanisms. The ability to retrieve these specific artifacts supports lateral movement and persistent access strategies within a targeted environment.
Mitigation for this vulnerability requires an immediate update to pH7Builder version 18.5.0 or later, where the developers have addressed the filtering logic in the UserController methods. For organizations unable to patch immediately due to dependency constraints, temporary mitigations should focus on restricting API key permissions to only those endpoints and actions strictly necessary for business operations. Implementing strict input validation and output encoding at the application layer can help reduce exposure, although this is not a substitute for fixing the root cause in the controller logic. Additionally, rotating all affected private API keys and resetting any exposed TOTP secrets or reset tokens is essential to invalidate potentially compromised credentials. Security teams should also audit their API gateway configurations to ensure that sensitive data fields are stripped from responses at the infrastructure level as an additional defense-in-depth measure against similar implementation flaws in other services.