CVE-2026-110907
7.5HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-669
Impact
Unauthenticated remote attackers can view unauthorized sensitive token types through the token browser. They only need network access to the target instance.
Root cause
The token browser fails to properly restrict access to available token types.
Affected systems
Backdrop CMS Core 1.34.x before 1.34.6 and 1.35.x before 1.35.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade to Backdrop CMS Core 1.34.6, 1.35.2, or newer. No interim mitigation is provided in the advisory.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.