CVE-2026-108905: Hard-Coded API Key Bypass pH7Builder

CVE ID	CVE-2026-108905
Severity	HIGH — CVSS CVSS V4.0 8.7
Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CWE	CWE-798 Use of Hard-coded Credentials
Produk	ph7software / ph7builder — 0 (affected), 18.6.0 (unaffected)
Dipublikasikan	2026-10-11

Ringkasan Cepat

• CVE-2026-108905 adalah kerentanan hard-coded API key di Tool.class.php pada pH7Builder sebelum 18.6.0.
• Penyerang tanpa autentikasi dapat mem-bypass pemeriksaan akses API dengan spoofing Host header.
• Severity HIGH 8.7 (CVSS v4.0); data member seperti email, IP, telepon, dan rekening bank berpotensi terambil.

Ringkasan Kerentanan

CVE-2026-108905 adalah kerentanan yang berdampak pada pH7Builder (pH7 Social Dating CMS) sebelum versi 18.6.0. Menurut deskripsi resmi, terdapat hard-coded API key di Tool.class.php yang memungkinkan penyerang tanpa autentikasi melewati pemeriksaan akses API dengan memalsukan Host header.

Kerentanan dipetakan ke CWE-798: Use of Hard-coded Credentials. Severity dinilai HIGH 8.7 berdasarkan CVSS v4.0 dengan vektor CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.

Dampak Teknis

Karena kunci API tertanam dalam kode, pemeriksaan akses dapat dilewati oleh pihak yang mengetahui mekanisme tersebut. Deskripsi resmi menyebut penyerang dapat mengambil data member berupa email, alamat IP, nomor telepon, dan field rekening bank.

Vektor CVSS menunjukkan serangan dapat dilakukan dari jaringan, tanpa hak istimewa, tanpa interaksi pengguna, dan berdampak tinggi pada kerahasiaan. Dampak pada integritas dan ketersediaan tidak dilaporkan, tetapi kebocoran data pribadi dan finansial tetap menjadi risiko utama.

Produk Terdampak

Vendor: ph7software. Produk: ph7builder. Status versi menurut data: 0 terdampak, 18.6.0 tidak terdampak. Dengan demikian, semua rilis sebelum 18.6.0 berpotensi terdampak dan perlu segera diperbarui.

Judul CNA: pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header.

Konteks dan Referensi

Kerentanan dipublikasikan pada 11 Oktober 2026. Perbaikan dapat ditelusuri melalui commit cfe1e0c418946b868db8c399d0cf6b122552efd2. Kode terkait berada di _protected/framework/Api/Tool.class.php.

Referensi lain: repositori pH7 Social Dating CMS dan advisory VulnCheck.

Mitigasi dan Perbaikan

• Perbarui pH7Builder ke versi 18.6.0 atau lebih baru; versi 18.6.0 dinyatakan tidak terdampak.
• Jika pembaruan belum memungkinkan, batasi akses publik ke endpoint API yang rentan dan terapkan validasi Host header agar hanya host resmi yang diterima.
• Rotasi atau ganti API key yang digunakan, dan jangan menyimpan kredensial secara hard-coded; gunakan environment variable atau secret manager.
• Audit log akses API untuk anomali, termasuk request dengan Host header tidak wajar dan pemanggilan tanpa autentikasi, lalu tindak lanjuti jika mencurigakan.
• Tinjau paparan data member dan perkuat kontrol akses; jika terjadi indikasi kebocoran, ikuti prosedur respons insiden dan kewajiban pelaporan.

Referensi Resmi

• CVE-2026-108905 — CVE Program (cve.org)
• https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/cfe1e0c418946b868db8c399d0cf6b122552efd2
• https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.5.1/_protected/framework/Api/Tool.class.php#L25-L48
• https://github.com/pH7Software/pH7-Social-Dating-CMS
• https://www.vulncheck.com/advisories/ph7builder-before-18.6.0-hard-coded-api-key-bypass-via-host-header

Artikel ini disusun dari data publik CVE Program (cve.org). Selalu verifikasi patch resmi dari vendor sebelum menerapkan perubahan.

Pertanyaan yang Sering Diajukan (FAQ)

Apa itu CVE-2026-108905?

Kerentanan hard-coded API key pada pH7Builder sebelum 18.6.0 yang memungkinkan bypass pemeriksaan akses API melalui spoofing Host header.

Versi mana yang terdampak?

Semua versi sebelum 18.6.0 berpotensi terdampak. Versi 18.6.0 dinyatakan tidak terdampak.

Seberapa parah kerentanan ini?

Severity HIGH 8.7 berdasarkan CVSS v4.0. Dampak utamanya adalah kebocoran kerahasiaan data.

Data apa yang berisiko terambil?

Deskripsi resmi menyebut email member, alamat IP, nomor telepon, dan field rekening bank.

Apa akar masalahnya?

CWE-798 Use of Hard-coded Credentials, yaitu penggunaan kredensial/API key yang tertanam di kode.

Apakah sudah ada eksploitasi publik?

Fakta yang tersedia tidak mencantumkan status eksploitasi publik. Langkah utama tetap memperbarui ke 18.6.0 dan menerapkan mitigasi.

English Version — CVE-2026-108905: Hard-Coded API Key Bypass in pH7Builder

Quick Summary

• CVE-2026-108905 is a hard-coded API key vulnerability in Tool.class.php in pH7Builder before 18.6.0.
• Unauthenticated attackers can bypass API access checks by spoofing the Host header.
• Severity HIGH 8.7 (CVSS v4.0); member data such as email, IP, phone, and bank account details may be retrieved.

Vulnerability Summary

CVE-2026-108905 is a vulnerability affecting pH7Builder (pH7 Social Dating CMS) before version 18.6.0. According to the official description, a hard-coded API key exists in Tool.class.php, allowing an unauthenticated attacker to bypass API access checks by spoofing the Host header.

The vulnerability is mapped to CWE-798: Use of Hard-coded Credentials. Severity is rated HIGH 8.7 based on CVSS v4.0 with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.

Technical Impact

Because the API key is embedded in the code, access checks can be bypassed by anyone who knows the mechanism. The official description states that an attacker can retrieve member data such as email, IP address, phone number, and bank account fields.

The CVSS vector indicates that the attack can be performed from the network, without privileges, without user interaction, and with a high impact on confidentiality. Impacts on integrity and availability are not reported, but the leakage of personal and financial data remains the primary risk.

Affected Products

Vendor: ph7software. Product: ph7builder. Version status according to the data: 0 affected, 18.6.0 not affected. Therefore, all releases before 18.6.0 are potentially affected and should be updated immediately.

CNA title: pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header.

Context and References

The vulnerability was published on October 11, 2026. The fix can be traced via commit cfe1e0c418946b868db8c399d0cf6b122552efd2. The related code is in _protected/framework/Api/Tool.class.php.

Other references: pH7 Social Dating CMS repository and VulnCheck advisory.

Mitigation

• Update pH7Builder to version 18.6.0 or later; version 18.6.0 is stated to be unaffected.
• If updating is not yet possible, restrict public access to the vulnerable API endpoint and enforce Host header validation so that only official hosts are accepted.
• Rotate or replace the API key in use, and do not store credentials in a hard-coded manner; use environment variables or a secret manager.
• Audit API access logs for anomalies, including requests with unusual Host headers and unauthenticated calls, and follow up if suspicious.
• Review member data exposure and strengthen access controls; if there are indications of a breach, follow incident response procedures and reporting obligations.

FAQ (English)

What is CVE-2026-108905?

A hard-coded API key vulnerability in pH7Builder before 18.6.0 that allows bypassing API access checks via Host header spoofing.

Which versions are affected?

All versions before 18.6.0 are potentially affected. Version 18.6.0 is stated to be unaffected.

How severe is this vulnerability?

Severity HIGH 8.7 based on CVSS v4.0. The main impact is leakage of data confidentiality.

What data is at risk of being retrieved?

The official description mentions member email, IP address, phone number, and bank account fields.

What is the root cause?

CWE-798 Use of Hard-coded Credentials, i.e., the use of credentials/API key embedded in code.

Has there been public exploitation?

Available facts do not list public exploitation status. The primary step remains updating to 18.6.0 and applying mitigations.