The vulnerability is a flaw in e107 CMS in which comment moderation actions do not enforce CSRF token validation. The session_handler::check() routine only validates a token if one is present; when a token is absent the check is skipped, allowing an attacker to trigger comment approval or rejection requests without user consent. This can result in publication of malicious content or removal of legitimate comments and is classified as a moderate severity issue (CVSS 6.5) associated with CWE‑352 and CWE‑285.

All installations of e107 CMS prior to version 2.3.5 are affected. The fix is included in release 2.3.5; no other vendors or products are listed.

With a CVSS score of 6.5 the risk is moderate, but no EPSS score is available and the CVE is not listed in CISA’s KEV catalog. The attack vector is web‑based; an adversary could send a crafted request to the moderation endpoint or lure an authenticated administrator to a malicious site that issues the request. Exploitation requires the victim to be authenticated, but the CSRF bypass removes the need for any additional privileges beyond the target’s authenticated session.