CVE-2026-104059 in Lektor
Summary
by MITRE • 10/01/2026
Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting. Attackers can exploit the newattachment, deleterecord, build, clean, and publish endpoints from a malicious web page to write arbitrary files, delete pages, wipe build output, trigger deployment publication, and via DNS rebinding reach read endpoints to disclose data.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Lektor versions 3.3.14 and 3.4.0b15 represents a critical failure in the implementation of Cross-Site Request Forgery protections within the administrative API blueprint. This flaw allows unauthenticated attackers to execute state-changing actions on behalf of an authenticated administrator by leveraging cross-origin requests that bypass standard browser security mechanisms such as CSRF tokens, Origin and Referer header validation, CORS configuration checks, and Host allowlisting. The absence of these fundamental safeguards means that any maliciously crafted web page can trigger API endpoints without the user's explicit consent or knowledge, effectively turning legitimate administrative functions into vectors for unauthorized manipulation.
The technical flaw centers on the lack of strict origin verification and token-based authentication for sensitive operations exposed through the admin API. By omitting checks for the Origin header, Referer header, and proper CORS headers, the application fails to distinguish between requests initiated by trusted sources and those forged from external domains. Furthermore, the reliance solely on session cookies without additional anti-CSRF tokens leaves the state-changing endpoints vulnerable to automated exploitation. This architectural oversight enables attackers to craft HTTP requests that appear legitimate to the server because they are sent with valid authentication cookies stolen or available in the context of a logged-in administrator's browser session.
The operational impact of this vulnerability is severe, as it grants attackers control over critical content management functions including newattachment, deleterecord, build, clean, and publish endpoints. Through these exposed interfaces, an attacker can write arbitrary files to the server filesystem, delete existing pages from the site structure, wipe the entire build output directory which disrupts service availability, and trigger deployment publication processes that may propagate malicious content or configurations to production environments. The ability to manipulate file systems directly through web requests significantly escalates the risk beyond simple data modification, potentially leading to remote code execution if combined with other vulnerabilities such as template injection or improper input sanitization in uploaded files.
Additionally, the vulnerability extends to read endpoints via DNS rebinding techniques, allowing attackers to bypass same-origin policies and disclose sensitive internal data that would otherwise be inaccessible from external domains. This capability enables information disclosure of configuration details, user credentials stored within the application database, or proprietary content before it is publicly published. The combination of write access through CSRF and read access through DNS rebinding creates a comprehensive attack surface where an attacker can not only deface or disrupt the website but also exfiltrate confidential data from behind firewalls that rely on network-level isolation rather than strict web application security controls.
To mitigate this vulnerability, immediate updates to Lektor are required as newer versions have addressed these authentication and validation gaps. In environments where upgrading is not immediately feasible, administrators should implement reverse proxy configurations that enforce strict Origin header checking for all API requests, ensuring that only known trusted domains can interact with the admin endpoints. Additionally, deploying Web Application Firewalls with CSRF detection capabilities can provide a layer of defense by identifying anomalous request patterns or missing tokens. It is also recommended to disable public access to the admin interface entirely unless absolutely necessary, restricting it to internal networks and requiring strong multi-factor authentication for all administrative actions to reduce the likelihood of session hijacking which often precedes such attacks.
This vulnerability aligns with CWE-352 Cross-Site Request Forgery due to the exploitation of user credentials to perform unauthorized state changes without consent. It also relates to CWE-942 Permissive Cross-domain Access with Untrusted Data given the lack of proper CORS and origin validation that allows external domains to interact with sensitive internal resources. From a tactical perspective, this falls under MITRE ATT&CK technique T1076 Remote File Inclusion if arbitrary file writes are exploited for code execution, or T1534 Internal Spearphishing when used in conjunction with social engineering to trick administrators into visiting malicious pages that trigger the forged requests automatically upon loading.