JVN#44272550
Akeeba multiple products vulnerable to cross-site request forgery
Overview
Multiple products provided by Akeeba Ltd. contain a cross-site request forgery vulnerability.
Products Affected
- Akeeba Backup for Joomla! versions prior to 10.3.7
- Akeeba Backup for WordPress versions prior to 9.1.8
- Akeeba Solo versions prior to 9.1.8
- Admin Tools for Joomla! versions prior to 7.9.0
Description
Multiple products provided by Akeeba Ltd. fail to check properly the anti-CSRF tokens on some actions.
- Cross-Site Request Forgery (CWE-352)
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 5.1
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Base Score 5.4
- CVE-2026-105296
Impact
If the user accesses a malicious page while logged into the affected product, unintended operations may be performed.
Solution
Update the Software
Update the software to the latest version according to the information provided by the developer.
Vendor Status
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
Credit
Kuniyoshi Noguchi @KuniNogu reported the vulnerability on Akeeba Backup for Joomla! to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
The developer found the vulnerability independently of our reporting and was progressing to release each fixed version.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2026-105296 |
| JVN iPedia |
|