{"id":"CVE-2026-105296","state":"PUBLISHED","title":"Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.","description":"Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.","publishedAt":"2026-11-04T04:46:52.231Z","updatedAt":"2026-11-04T04:46:52.231Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","source":"jpcert"},"assigner":"jpcert","products":["Akeeba Ltd. Akeeba Backup for Joomla!","Akeeba Ltd. Akeeba Backup for WordPress","Akeeba Ltd. Akeeba Solo","Akeeba Ltd. Admin Tools for Joomla!"],"affected":[{"vendor":"Akeeba Ltd.","product":"Akeeba Backup for Joomla!","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"10.3.7","versionType":"semver"}]},{"vendor":"Akeeba Ltd.","product":"Akeeba Backup for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"9.1.8","versionType":"semver"}]},{"vendor":"Akeeba Ltd.","product":"Akeeba Solo","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"9.1.8","versionType":"semver"}]},{"vendor":"Akeeba Ltd.","product":"Admin Tools for Joomla!","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.9.0","versionType":"semver"}]}],"references":["https://www.akeeba.com/download/akeeba-backup/10-3-7.html","https://www.akeeba.com/news/1789-security-hardening-in-todays-akeeba-backup-solo-and-admin-tools-releases.html","https://jvn.jp/en/jp/JVN44272550/"],"weaknesses":["CWE-352"],"ingestedAt":"2026-11-04T04:50:06.736Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/105xxx/CVE-2026-105296.json","commit":"f0b25a921c6f506262b20da3b1044cf626a4a3cb","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-105296","state":"PUBLISHED","datePublished":"2026-11-04T04:46:52.231Z","dateUpdated":"2026-11-04T04:46:52.231Z","assignerShortName":"jpcert","assignerOrgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateReserved":"2026-10-05T03:10:13.316Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed."}],"affected":[{"vendor":"Akeeba Ltd.","product":"Akeeba Backup for Joomla!","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"10.3.7","versionType":"semver"}]},{"vendor":"Akeeba Ltd.","product":"Akeeba Backup for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"9.1.8","versionType":"semver"}]},{"vendor":"Akeeba Ltd.","product":"Akeeba Solo","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"9.1.8","versionType":"semver"}]},{"vendor":"Akeeba Ltd.","product":"Admin Tools for Joomla!","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.9.0","versionType":"semver"}]}],"references":[{"url":"https://www.akeeba.com/download/akeeba-backup/10-3-7.html"},{"url":"https://www.akeeba.com/news/1789-security-hardening-in-todays-akeeba-backup-solo-and-admin-tools-releases.html"},{"url":"https://jvn.jp/en/jp/JVN44272550/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_0":{"version":"3.0","baseSeverity":"MEDIUM","baseScore":5.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}},{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV4_0":{"version":"4.0","baseSeverity":"MEDIUM","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","description":"Cross-site request forgery (CSRF)","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"jpcert","orgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateUpdated":"2026-11-04T04:46:52.231Z"}}}}}