CVE-2026-110907: High severity Backdrop CMS Backdrop CMS Core vulnerability
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Backdrop CMS Coreto a version that resolves this vulnerability.Fixed in 1.35.2 - Upgrade
Upgrade
Backdrop CMS Coreto a version that resolves this vulnerability.Fixed in 1.34.6
Event History
Frequently Asked Questions
Which deployments are affected?
Backdrop CMS Core versions 1.35.x before 1.35.2 and 1.34.x before 1.34.6 are affected.
Does exploitation require an authenticated account or user interaction?
No. The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the likely security impact?
The issue is rated high severity with high confidentiality impact. Individual token names remain adequately protected, but access to token types in the token browser is not sufficiently restricted.
How can I determine whether the issue has been addressed?
Verify the installed Backdrop CMS Core version. Versions 1.35.2 and later in the 1.35.x line, and 1.34.6 and later in the 1.34.x line, are not listed as affected.