Vulnerability · Published Oct 15, 2026 · Assigned by mitre

CVE-2026-110907

High 7.5

In plain English

A high-severity security flaw in Backdrop from BackdropCMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 73.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.

Affected products (as reported)

Vendor	Product	Versions
BackdropCMS	Backdrop	1.35.0 – before 1.35.21.34.0 – before 1.34.6

Weakness: CWE-669 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://backdropcms.org/security/backdrop-sa-core-2026-009 vendor-advisory