CVE-2026-108904

Name of the Vulnerable Software and Affected Versions pH7Builder versions prior to 18.5.0

Description An information disclosure issue exists where API clients can obtain sensitive member data. This occurs because the users() and user() functions within the UserController return unfiltered database rows. An attacker with a valid private API key can retrieve bcrypt password hashes, non-expiring hashValidation reset tokens, and TOTP (Time-based One-Time Password) secrets, which can lead to account takeover and the bypassing of two-factor authentication.

Recommendations Update to version 18.5.0 or later.