Vulnerability · Published Nov 4, 2026 · Assigned by jpcert
CVE-2026-105296
Medium 5.4
In plain English
A medium-severity cross-site request forgery in Admin Tools for Joomla! from Akeeba Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 3.0)5.4Medium
Exploit odds (30 days)0.1%top 98.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Akeeba Ltd. | Akeeba Backup for Joomla! | 0 – before 10.3.7 |
| Akeeba Ltd. | Akeeba Backup for WordPress | 0 – before 9.1.8 |
| Akeeba Ltd. | Akeeba Solo | 0 – before 9.1.8 |
| Akeeba Ltd. | Admin Tools for Joomla! | 0 – before 7.9.0 |
Weakness: CWE-352 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N