CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints
Unauthenticated attackers can exploit CSRF in Lektor admin API to modify content, delete pages, or disclose data via malicious cross-origin requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-104059?
CVE-2026-104059 is a high-severity vulnerability in lektor, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting. Attackers can exploit the newattachment, deleterecord, build, clean, and publish endpoints from a malicious web page to write arbitrary files, delete pages, wipe build output, trigger deployment publication, and via DNS rebinding reach read endpoints to disclose data.
Weakness: CWE-352
Which versions are affected by CVE-2026-104059?
How do I fix CVE-2026-104059?
No fix has been published for CVE-2026-104059 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-104059 being exploited?
There is no known exploitation of CVE-2026-104059 in the wild and no public exploit code.
Sources
Also known as GHSA-76hh-mx5x-4xrx.