{"uuid": "bb71182a-b15f-4947-b3aa-2398af604331", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108905", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422889650330915", "content": "CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108905https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/cfe1e0c418946b868db8c399d0cf6b122552efd2https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.5.1/_protected/framework/Api/Tool.class.php#L25-L48https://github.com/pH7Software/pH7-Social-Dating-CMShttps://www.vulncheck.com/advisories/ph7builder-before-18.6.0-hard-coded-api-key-bypass-via-host-header#ph7software #ph7builder#CVE_2026_108905#bot", "creation_timestamp": "2026-10-11T15:05:04.830926Z"}