CVE-2026-110907 Overview
CVE-2026-110907 is an access control vulnerability affecting Backdrop CMS Core versions 1.35.x before 1.35.2 and 1.34.x before 1.34.6. The flaw involves improper handling of tokens, which are placeholder strings such as [node:title] or [user:name] used to inject dynamic data into text content. Backdrop CMS provides a browser interface for selecting these tokens by type. The product fails to sufficiently restrict access to the types of tokens exposed in the token browser, enabling unauthenticated attackers to enumerate token categories. The individual token names themselves remain adequately protected.
Critical Impact
Network-accessible attackers can enumerate restricted token types without authentication, potentially exposing information about the site's content structure and configuration.
Affected Products
- Backdrop CMS Core 1.35.x prior to 1.35.2
- Backdrop CMS Core 1.34.x prior to 1.34.6
- Backdrop CMS installations exposing the token browser interface
Discovery Timeline
- 2026-10-15 - CVE-2026-110907 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-110907
Vulnerability Analysis
The vulnerability resides in the token browser component of Backdrop CMS Core. Tokens serve as placeholders that are dynamically replaced with runtime values such as node titles, usernames, or system variables. The token browser interface allows site editors to discover available tokens grouped by type. The affected versions do not enforce adequate access restrictions on which token types the interface exposes to requesters. An attacker querying the token browser can observe token categories that should be restricted to privileged users. While individual token names remain protected, the exposure of token type metadata leaks structural information about the Backdrop CMS installation.
Root Cause
The root cause is tracked under CWE-669: Incorrect Resource Transfer Between Spheres. The token browser transfers token type information across a trust boundary without validating whether the requester holds the required permissions. Backdrop CMS applies access controls at the token name level but omits equivalent controls at the token type enumeration level.
Attack Vector
An unauthenticated remote attacker reaches the token browser endpoint over the network. The attacker requests the list of available token types and receives category data that should be filtered based on user permissions. No user interaction is required, and the attack complexity is low. The vulnerability does not permit modification of data or disruption of service; impact is limited to confidentiality of token type metadata.
See the Backdrop CMS Security Advisory for technical details published by the maintainers.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-110907
Indicators of Compromise
- Unauthenticated HTTP requests to Backdrop CMS token browser endpoints from external IP addresses
- Repeated requests enumerating token types from a single source within a short time window
- Access log entries referencing the token browser path from clients lacking valid authenticated session cookies
Detection Strategies
- Review web server access logs for requests to the token browser interface originating from unauthenticated sessions
- Correlate token browser requests with user privilege levels to identify requests that should have been denied
- Deploy web application firewall (WAF) rules to flag anomalous access patterns against administrative Backdrop CMS endpoints
Monitoring Recommendations
- Enable verbose logging on Backdrop CMS administrative routes and forward logs to a central SIEM for correlation
- Alert on spikes in traffic to token browser URLs that do not correspond to authenticated editor activity
- Track the running Backdrop CMS version against the fixed releases 1.35.2 and 1.34.6 across all deployed sites
How to Mitigate CVE-2026-110907
Immediate Actions Required
- Upgrade Backdrop CMS Core to version 1.35.2 or 1.34.6 as published in the vendor advisory
- Audit administrative route exposure and ensure the token browser is reachable only by authenticated users with the appropriate role
- Review web server access logs for prior unauthenticated requests to the token browser endpoint
Patch Information
The Backdrop CMS maintainers released fixed versions 1.35.2 and 1.34.6 to address the token type access control gap. Administrators should apply the update through the standard Backdrop CMS upgrade process. Refer to the Backdrop CMS Security Advisory SA-CORE-2026-009 for the official patch notes and upgrade instructions.
Workarounds
- Restrict network access to the Backdrop CMS administrative interface using IP allowlisting at the reverse proxy or WAF
- Enforce authentication on all paths that invoke the token browser until the patch is applied
- Reduce the exposed attack surface by placing the admin interface behind a VPN or zero-trust access gateway
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
