CVE-2026-110907

Executive Summary

CVE-2026-110907 is an access-control weakness (CWE-669: Incorrect Resource Transfer Between Spheres) in Backdrop CMS Core affecting the token browser, a UI component that enumerates available replacement tokens such as [node:title] and [user:name]. Versions 1.35.x before 1.35.2 and 1.34.x before 1.34.6 do not sufficiently restrict which token types are exposed through that browser, allowing an unauthenticated attacker to enumerate token types and infer sensitive dynamic-data relationships that should not be visible. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the impact is confidentiality-focused, exploitable remotely with no privileges or user interaction, and the vendor has released fixed versions but no patch reference is available in the tracked sources.

Technical Analysis

Backdrop CMS implements a token subsystem that replaces small placeholder strings — for example [node:title] or [user:name] — with dynamic values when content is rendered or processed. A browser UI is provided to let users select tokens by type. The vulnerability lies in how that browser filters token types: while the individual token names are adequately protected, the product "doesn't sufficiently limit access to the types of tokens that are available in the token browser."

Per the CWE-669 classification, the flaw is fundamentally about resources (in this case, token-type metadata) crossing a trust boundary they should not cross. An unauthenticated request that reaches the token browser receives a listing of token types that is broader than intended, because the access checks applied at that layer are incomplete. The exposure is therefore an information disclosure condition: it does not grant modification capabilities, it does not permit injection, and it does not by itself yield code execution. What it yields is a map of the site's internal data model — which token types exist and therefore what kinds of entities, fields, and relationships the installation makes available to the token engine.

The CVSS subscores are consistent with this reading. C:H reflects the meaningful confidentiality loss from enumerating internal data types; I:N and A:N confirm there is no integrity or availability impact described; PR:N and UI:N confirm the enumeration is reachable without authentication and without tricking a user; AC:L confirms no special conditions are required; and S:U confirms the impact stays within the vulnerable component's security authority. No function names, route paths, or parameter names are available in the provided description, so the specific request shape that exercises the browser is not asserted here. The description also does not state whether the exposure is limited to token types, token type groupings, or the metadata attached to those groups; only the type-level restriction failure is documented.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code exists for this CVE as of the provided data. The chain below is inferred from the vulnerability class (broken access control on an information-disclosure surface) and from the explicit statement that the token browser is the affected component.

1. Reconnaissance / target identification. An attacker locates Backdrop CMS installations — a relatively small ecosystem — using search-engine or Shodan-style fingerprints (e.g., the Backdrop CMS string, characteristic core asset paths). Version fingerprinting then narrows the target set to 1.35.x < 1.35.2 and 1.34.x < 1.34.6, the ranges documented as vulnerable.

2. Triggering the flaw class. Because the access restriction on token types is insufficient and the endpoint is reachable with PR:N / UI:N, the attacker reaches the token browser surface directly, without an authenticated session and without any user interaction. The act of requesting the browser is what triggers the disclosure: the response is expected to return a broader set of token types than the requester is entitled to see, whereas individual token names remain protected.

3. Payload / execution method. There is no payload in the classic sense. This is a read-only enumeration primitive. The "payload" is simply the crafted request to the token browser (the exact request shape is not specified in the available data). The attacker harvests whatever token-type listing the under-restricted response returns.

4. Post-exploitation impact. The harvested token-type inventory is used to build a model of the site: which entity types, field structures, and content relationships exist and are wired into the token system. That knowledge is a recon multiplier — useful for planning later, separate attacks against other components, for identifying third-party module footprints and their associated data, and for prioritizing targets. By itself, this CVE does not give the attacker data values, write access, or execution; it gives them the site's structural map.

Impact Assessment

The direct impact is confidentiality loss (CVSS C:H) on affected Backdrop CMS installations running 1.35.x < 1.35.2 or 1.34.x < 1.34.6. Integrity and availability are unaffected (I:N, A:N). Exploitability is high in the sense relevant to triage: AV:N (network reachable), AC:L (no special preconditions), PR:N (no credentials), UI:N (no victim interaction). The overall 7.5 score places this in the high-severity band despite the absence of code execution, because the disclosure is trivially reachable and the exposed metadata is of genuine planning value.

Blast radius is bounded by the population of internet-facing Backdrop installations in the affected version ranges, plus any internal/partner-facing deployments that expose the token browser. Because no privileged session is needed, every reachable instance in the affected range should be treated as potentially enumerable. There is no evidence in the provided data of exploit-in-the-wild activity, CISA KEV listing, or threat-actor association. EPSS is not yet scored, so no probabilistic exploitation estimate is asserted.

Detection Guidance

Detection centers on unexpected, unauthenticated access to the token browser surface and on anomalous enumeration patterns from single sources. Because no request-path specifics are provided, the rules below key on Backdrop CMS context and on generic enumeration behavior rather than on a single invented URL.

Sigma Rule

title: Backdrop CMS Token Browser Type Enumeration Attempt
id: 4f2c9a17-0c3e-4b8a-9d21-backdrop-cve-2026-110907
status: experimental
description: Detects requests to the Backdrop CMS token browser consistent with CVE-2026-110907 type-enumeration abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110907
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - 'token'
      - 'token_browser'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_ua:
    cs-user-agent|contains:
      - 'curl'
      - 'python'
      - 'Go-http-client'
      - 'sqlmap'
      - 'nikto'
  timeframe: 5m
  condition: selection_path and selection_method and selection_ua
fields:
  - c-ip
  - cs-uri-stem
  - cs-user-agent
falsepositives:
  - Legitimate administrator token browsing while authenticated
  - Internal automation using curl against non-sensitive endpoints
level: medium
tags:
  - attack.t1213
  - cve.2026.110907

YARA Rule

rule CVE_2026_110907_Backdrop_Token_Type_Disclosure
{
    meta:
        description = "Detects Backdrop CMS token browser responses that disclose an over-broad token type listing (CVE-2026-110907)."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110907"
        date = "2026-01-01"
        severity = "high"

    strings:
        $bd1 = "Backdrop CMS" ascii nocase
        $bd2 = "token_browser" ascii nocase
        $tok1 = "[node:" ascii
        $tok2 = "[user:" ascii
        $type = "token_type" ascii nocase
        $grp  = "token group" ascii nocase

    condition:
        $bd1 and $bd2 and any of ($tok*) and ($type or $grp)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110907 Backdrop CMS Token Browser Enumeration Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"token"; nocase; http.user_agent; content:"curl"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-110907; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110907; sid:2026110907; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where network.protocol == "http" and
      url.path : "*token*" and
      http.request.method : ("GET", "POST") ]
  [ network where network.protocol == "http" and
      url.path : "*token*" and
      http.request.method : ("GET", "POST") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval path=lower(uri)
| where like(path, "%token%")
| eval suspicious_ua=if(match(lower(useragent), "(curl|python|go-http|sqlmap|nikto|wget)"), 1, 0)
| stats count AS hits, values(useragent) AS agents, dc(uri) AS distinct_paths
    BY clientip, status
| where hits >= 5 AND distinct_paths >= 1
| sort - hits

Wazuh OSSEC Rule

<group name="web,backdrop,cve-2026-110907,">
  <rule id="1109070" level="6">
    <if_sid>31100</if_sid>
    <id>^CVE-2026-110907</id>
    <description>Backdrop CMS token browser enumeration attempt detected (CVE-2026-110907)</description>
    <group>attempted_recon,pci_dss_10.2.4,</group>
  </rule>

  <rule id="1109071" level="10" frequency="5" timeframe="60">
    <if_matched_sid>1109070</if_matched_sid>
    <same_source_ip />
    <description>Repeated Backdrop CMS token browser enumeration from same source (CVE-2026-110907)</description>
    <group>attempted_recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Because the flaw is an unauthenticated information disclosure on the token browser, the fastest containment is to restrict who can reach that surface. Where feasible, restrict access to the token browser to authenticated, appropriately privileged sessions at the web-server / reverse-proxy / WAF layer, rather than relying on application-layer type filtering. Deploy temporary block or challenge rules for requests to token-browser functionality from anonymous clients. Monitor and rate-limit single-source enumeration patterns using the detection logic above. Because PR:N and UI:N apply, do not assume that disabling registration or login-only access removes exposure — the browser must be protected directly.

2. Patch / upgrade steps. Fixed versions exist: upgrade Backdrop CMS Core to 1.35.2 (for the 1.35.x line) or 1.34.6 (for the 1.34.x line). Both branches have a dedicated fixed release, so select the branch matching your current minor line and move forward to that release. No specific commit, changelog entry, or vendor advisory reference was included in the tracked sources, so verify the upgrade against the official Backdrop CMS release notes before and after applying. Back up the site database and files prior to upgrading, and test in staging first given Backdrop's module/dependency surface.

3. Long-term hardening. Enforce least privilege on all token-related administrative surfaces, and audit any custom or contributed modules that register token types for equivalent over-exposure. Add authenticated-only enforcement as a default posture for browser-style administrative endpoints. Maintain a version inventory of Backdrop installations so affected ranges can be found quickly, and integrate CVE feeds so future Backdrop advisories are triaged automatically. Given the absence of patch evidence in the tracked sources, treat this as UNPATCHED-AWARE until the fixed releases are independently verified in your environment.

References

1. NVD — CVE-2026-110907: https://nvd.nist.gov/vuln/detail/CVE-2026-110907
2. CWE-669 — Incorrect Resource Transfer Between Spheres: https://cwe.mitre.org/data/definitions/669.html
3. Backdrop CMS official release notes (verify fixed releases 1.35.2 and 1.34.6): https://backdropcms.org/
4. FIRST EPSS (no score available at time of writing): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities catalog (CVE-2026-110907 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaigns, public proof-of-concept code, Nuclei templates, or exploit-in-the-wild evidence were identified for CVE-2026-110907 in the provided data.