Read the docs
TI-2026-74576 Aliases CVE-2026-110907

Backdrop CMS Core exposes restricted token types in token browser

Priority LOW 39CWE-669Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Backdrop CMS Core from 1.35.0 before 1.35.2 and from 1.34.0 before 1.34.6 does not sufficiently limit access to the token types shown in the token browser (CWE-669). A remote attacker without privileges can access restricted token data, with high confidentiality impact. The names of the individual tokens remain protected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00335 27th percentileScored 2026-11-07
Fix Fixed Backdrop (BackdropCMS): 1.35.2, 1.34.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backdropcmsBackdrop1.35.0 to before 1.35.2; 1.34.0 to before 1.34.61.35.2, 1.34.6Patch availableCNA
  • Backdrop Vendorbackdropcms Affected 1.35.0 to before 1.35.2; 1.34.0 to before 1.34.6 Fixed in 1.35.2, 1.34.6 Patch available CNA

Remediation

Update Backdrop CMS Core to version 1.35.2 on the 1.35.x branch and to version 1.34.6 on the 1.34.x branch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Backdrop (BackdropCMS) Fixed in 1.35.2, 1.34.6

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-110907
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-20 CISA SSVC decision points changed

References

Advisory 1

  • TI-2019-08480 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles… CVSS 3.1MEDIUM 6.1
  • TI-2025-39465 Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate… CVSS 3.1MEDIUM 6.1
  • TI-2023-14781 A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS… CVSS 3.1MEDIUM 4.8
  • TI-2022-20387 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' . CVSS 3.1MEDIUM 4.8
  • TI-2022-20386 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8
  • TI-2022-20385 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences