Cross-site request forgery in Akeeba Backup for Joomla!
Priority LOW 22CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.
Summary
Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00116 1st percentileScored 2026-11-07
Fix Fixed Akeeba Backup for Joomla! (Akeeba Ltd.): 10.3.7Akeeba Backup for WordPress (Akeeba Ltd.): 9.1.8+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Akeeba Ltd. | Akeeba Backup for Joomla! | before 10.3.7 | 10.3.7 | Patch available | CNA |
| Akeeba Ltd. | Akeeba Backup for WordPress | before 9.1.8 | 9.1.8 | Patch available | CNA |
| Akeeba Ltd. | Akeeba Solo | before 9.1.8 | 9.1.8 | Patch available | CNA |
| Akeeba Ltd. | Admin Tools for Joomla! | before 7.9.0 | 7.9.0 | Patch available | CNA |
- Akeeba Backup for Joomla! VendorAkeeba Ltd. Affected before 10.3.7 Fixed in 10.3.7 Patch available CNA
- Akeeba Backup for WordPress VendorAkeeba Ltd. Affected before 9.1.8 Fixed in 9.1.8 Patch available CNA
- Akeeba Solo VendorAkeeba Ltd. Affected before 9.1.8 Fixed in 9.1.8 Patch available CNA
- Admin Tools for Joomla! VendorAkeeba Ltd. Affected before 7.9.0 Fixed in 7.9.0 Patch available CNA
Remediation
- Fix · CNA Akeeba Backup for Joomla! (Akeeba Ltd.) Fixed in 10.3.7
- Fix · CNA Akeeba Backup for WordPress (Akeeba Ltd.) Fixed in 9.1.8
- Fix · CNA Akeeba Solo (Akeeba Ltd.) Fixed in 9.1.8
- Fix · CNA Admin Tools for Joomla! (Akeeba Ltd.) Fixed in 7.9.0
Timeline
- 2026-11-04 Threatist record created from CVE-2026-105296
- 2026-11-04 Alias added: GHSA-58g4-6m6r-79h4
- 2026-11-04 CISA SSVC decision points changed
References
Sources
- CVE-2026-105296 · CVE Program
- CVE-2026-105296 · NVD
- FIRST EPSS
- GHSA-58g4-6m6r-79h4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences