CVE-2026-105296 · Other
NO FIX YET
Several Akeeba products skip the anti-forgery (CSRF) check on some actions. A user logged into one of them who opens a malicious page can have unintended operations performed on their behalf.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites and servers running Akeeba products are exposed when a logged-in administrator visits a malicious page. The sources do not name the affected products or versions, so the exact scope is unknown. Teams that do not run Akeeba software can skip it.
Not affected if logged-out-admins, no-akeeba-products
Who cares akeeba, self-hosted, web-admin
Unknown from the sources.
No fix yet, per the sources.
Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.
This page as .md · .json · in your agent: get_signal("CVE-2026-105296") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.