Vulnerability · Published Oct 1, 2026 · Assigned by VulnCheck

CVE-2026-104059Lektor 3.3.14 CSRF via Admin API Endpoints

High 8.1

In plain English

A high-severity cross-site request forgery in lektor from lektor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.1%top 96.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting. Attackers can exploit the newattachment, deleterecord, build, clean, and publish endpoints from a malicious web page to write arbitrary files, delete pages, wipe build output, trigger deployment publication, and via DNS rebinding reach read endpoints to disclose data.

Affected products (as reported)

Vendor	Product	Versions
lektor	lektor	0 – through 3.3.143.4.0b1 – through 3.4.0b15

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References

Researcher Disclosure technical-description
https://www.vulncheck.com/advisories/lektor-csrf-via-admin-api-endpoints third-party-advisory