CVE-2026-110907

EUVD-2026-101813
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 14.62%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
backdropcmsbackdrop
1.35.0 ≤
𝑥
< 1.35.2
CNA
backdropcmsbackdrop
1.34.0 ≤
𝑥
< 1.34.6
CNA
Common Weakness Enumeration
References
https://backdropcms.org/security/backdrop-sa-core-2026-009