CVE-2026-110907 Information disclosure in Backdrop
An attacker can view restricted token types in the Backdrop CMS token browser due to insufficient access controls, potentially exposing internal data structures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110907?
CVE-2026-110907 is a high-severity vulnerability in BackdropCMS Backdrop, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.
Weakness: CWE-669
Which versions are affected by CVE-2026-110907?
How do I fix CVE-2026-110907?
No fix has been published for CVE-2026-110907 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-110907 being exploited?
There is no known exploitation of CVE-2026-110907 in the wild and no public exploit code.
Sources
Also known as GHSA-mjqr-crv8-558q.