Token Mismanagement in Backdrop CMS by Backdrop
CVE-2026-110907

7.5HIGH

Key Information:

Vendor

Backdropcms

Status
Backdrop
Vendor
CVE Published:
15 October 2026

What is CVE-2026-110907?

Backdrop CMS Core versions 1.35.x prior to 1.35.2 and 1.34.x prior to 1.34.6 exhibit a vulnerability in how tokens are managed. Tokens serve as placeholders for dynamic data insertion in text. The platform inadequately restricts access to the available tokens in the token browser, which could lead to unauthorized data manipulation or exposure. Although the individual token names are sufficiently protected, ensuring proper access control on the token types is essential to mitigate potential security risks.

Affected Version(s)

Backdrop 1.35.0 < 1.35.2

Backdrop 1.34.0 < 1.34.6

References

https://backdropcms.org/security/backdrop-sa-core-2026-009
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.