CVE-2010-1627

phpBB 3.0.7 allows remote attackers to bypass intended access restrictions

4.3 MediumFix available

CVE-2010-1627 is a medium vulnerability (CVSS 4.3) in Phpbb, published May 19, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 65th percentile. A source reports a fix.

feed.php in phpBB 3.0.7 before 3.0.7-PL1 does not properly check permissions for feeds, which allows remote attackers to bypass intended access restrictions via unspecified attack vectors related to permission settings on a private forum.

Exploit likelihood

1.11%Unchanged since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2010-1627
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2010-1627
Updated: 2026-11-02

EUVDEUVD-2010-1650 No score

Record: EUVD-2010-1650
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8h9c-rcwj-jg8p 7.6

phpBB 3.0.7 allows remote attackers to bypass intended access restrictions

Record: GHSA-8h9c-rcwj-jg8p
CVSS 4.0: 7.6 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-863
Updated: 2026-11-02

Affected products

phpbb

Affected packages

Affected packages
Package	Affected	Fixed
`phpbb/phpbb` Packagist	Source text: > 3.0.6, < 3.0.7-PL1	3.0.7-PL1Not evaluated

Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD

Exploit likelihood

What each source reports

Affected products

Affected packages

History

References