CVE-2026-105296: CSRF
Published Nov 4, 2026
·Updated
Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.
Event History
Nov 4, 2026
CVE Published
via MITRE·04:46 AM
Data Sourced
via MITRE·04:46 AM
DescriptionSeverity
Data Sourced
via NVD·05:18 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Users who are logged in to an affected Akeeba product and then access a malicious page are exposed to unintended actions being performed through their authenticated session.
2
What does an attacker need to exploit it?
An attacker needs to cause a logged-in user to access a malicious page. No attacker authentication is indicated, but user interaction is required.
3
What is the potential impact?
The issue may allow unintended operations in the product, with low impact to confidentiality and integrity. No availability impact is indicated by the supplied severity vector.