CVE-2026-110907
Received Received - Intake

Cross-Site Scripting in Backdrop CMS Core

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: MITRE

Description
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-110907
EUVD
EUVD-2026-101813

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
BackdropCMS Backdrop 1.35.0
BackdropCMS Backdrop 1.34.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-669 The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Backdrop CMS versions before 1.35.2 and 1.34.6. It involves the token browser not properly restricting access to token types, allowing users to view more token types than intended. While token names are protected, the types of tokens available are not sufficiently limited, potentially leading to information disclosure.

Detection Guidance

Check your Backdrop CMS version by running: drush status or visit the admin dashboard. If your version is below 1.35.2 or 1.34.6, the system is vulnerable. Inspect token browser access logs for unusual token type requests.

Impact Analysis

An attacker could exploit this to access sensitive token types, potentially revealing dynamic data that should be restricted. This could lead to unauthorized information disclosure, such as user details or node content, depending on the exposed tokens.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Compliance may be compromised if sensitive data is exposed through improper token access.

Mitigation Strategies

Update Backdrop CMS to version 1.35.2 or 1.34.6 immediately. Review and restrict user roles with access to the token browser. Monitor for unauthorized token type access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart