CVE-2026-110907 in Backdrop
Summary
by MITRE • 10/15/2026
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
Backdrop CMS versions prior to 1.35.2 and 1.34.6 contain a vulnerability related to insufficient control over accessible token types within the content editing interface. In this context, tokens function as placeholder strings such as [node:title] or [user:name], which are designed to automatically insert dynamic data into text fields during content creation or modification. The system includes a browser feature that allows users to select these tokens by category type rather than typing them manually. While the individual token names themselves remain protected and inaccessible through unauthorized means, the mechanism for selecting available token types lacks adequate access restrictions. This architectural flaw permits authenticated users with lower privilege levels to potentially view or utilize token categories intended for administrative functions, thereby expanding their ability to manipulate dynamic content in ways that may exceed their authorized scope of operation.
The technical root cause lies in the permission checks applied to the token browser interface rather than the tokens themselves. The vulnerability classifies as an Access Control issue where the system fails to enforce proper authorization policies on specific functional components within a larger application module. This aligns with CWE-284, which describes Improper Access Control, specifically regarding insufficient restrictions on access to data objects or functions for unauthorized actors. By allowing lower-level users to interact with administrative token categories, the CMS inadvertently exposes internal logic and potential integration points that should remain restricted. Although no direct code execution occurs, this misconfiguration can facilitate further attacks by providing attackers with insights into system structure or enabling them to craft more sophisticated injection payloads using dynamic data sources they would otherwise not be able to reference directly.
From an operational perspective, the impact of this vulnerability is primarily centered on information disclosure and privilege escalation within the content management workflow. An attacker who has gained authenticated access as a low-privilege user could exploit this flaw to identify which administrative tokens are available in the system environment. This knowledge can be leveraged to understand how dynamic data is processed or to attempt to inject malicious input into fields that accept these specific token types, potentially leading to Cross-Site Scripting if those outputs are rendered without proper sanitization elsewhere in the application flow. Furthermore, it undermines the principle of least privilege by allowing users to perceive capabilities reserved for administrators, which can aid in reconnaissance efforts during a broader attack campaign against the web application infrastructure.
Mitigation strategies focus on applying the vendor-released patches that address these access control deficiencies immediately upon availability. Administrators should upgrade Backdrop CMS to version 1.35.2 or later if running the 1.35.x branch, or to version 1.34.6 or later for those on the 1.34.x branch. Until patches are applied, administrators can implement compensating controls by restricting access to the content editing interface through web application firewalls that monitor for unusual patterns in token browser interactions. Additionally, enforcing strict role-based access control policies ensures that only users with explicit administrative privileges can interact with advanced configuration modules where such tokens might be exposed. Regular security audits of user roles and permissions within the CMS backend are recommended to ensure that functional boundaries align strictly with intended privilege levels, thereby reducing the attack surface associated with misconfigured access controls. This incident highlights the importance of securing not just data but also the interfaces used to manipulate dynamic content structures within web applications.