CVE-2026-105296

MediumCVSS 5.1/10Last modified Nov 6, 2026

Description

Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Akeeba Ltd.	Akeeba Backup for Joomla!	< 10.3.7
Akeeba Ltd.	Akeeba Backup for WordPress	< 9.1.8
Akeeba Ltd.	Akeeba Solo	< 9.1.8
Akeeba Ltd.	Admin Tools for Joomla!	< 7.9.0

References

Timeline

Published: Nov 4, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1052977.5Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decode CVE-2026-1052986.3Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filt CVE-2026-1052998.7Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and CVE-2026-10534.4The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versi CVE-2026-105305.3The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, CVE-2026-1053025.7A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mappe CVE-2026-1053055.4A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devi CVE-2026-1053066.5A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the CVE-2026-1053077.3A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the compone CVE-2026-105315.4The AI Share & Summarize WordPress plugin before 2.0.4 does not sanitise and escape some of its shortcode attributes before outputting them CVE-2026-1053117.7The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set s CVE-2026-1053129.9A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container imag