Description
Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.
Published: 2026-11-04
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 04 Nov 2026 09:45:00 +0000

Type Values Removed Values Added
Title Cross‑Site Request Forgery Vulnerability in Multiple Akeeba Joomla and WordPress Backup Tools

Wed, 04 Nov 2026 05:00:00 +0000

Type Values Removed Values Added
Description Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.
Weaknesses CWE-352
References
Metrics cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-11-04T15:18:57.166Z

Reserved: 2026-10-05T03:10:13.316Z

Link: CVE-2026-105296

cve-icon Vulnrichment

Updated: 2026-11-04T15:10:59.766Z

cve-icon NVD

Status : Received

Published: 2026-11-04T05:18:21.367

Modified: 2026-11-04T16:17:32.493

Link: CVE-2026-105296

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T09:45:11Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)