Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.

zetlyn/cve-nvd vulnerability cve CVE-2026-104476 known 2026-10-03

https://nvd.nist.gov/vuln/detail/CVE-2026-104476

Properties

cvss	5.9 receipt Source NVD Its words `5.9` Read by `field:cve.metrics.cvssMetricV31[].cvssData.baseScore` Said since 2026-10-03 06:07 UTC Last answered 2026-10-05 12:24 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "product": "backdrop", "vendor": "backdrop", "versions": [ { "lessThan": "1.35.1", "status": "affected", "version": "0", "versionType": "semver" }, { "status": "unaffected", "version": "1.35.1", "versionType": "semver" } ] } ], "source": "disclosure@vulncheck.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings." } ], "id": "CVE-2026-104476", "lastModified": "2026-10-03T00:16:35.747", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "disclosure@vulncheck.com", "type": "Secondary" } ] }, "published": "2026-10-03T00:16:35.747", "references": [ { "source": "disclosure@vulncheck.com", "url": "https://backdropcms.org/security/backdrop-sa-core-2026-006" }, { "source": "disclosure@vulncheck.com", "url": "https://github.com/backdrop/backdrop" }, { "source": "disclosure@vulncheck.com", "url": "https://github.com/backdrop/backdrop/commit/1ae67061d9d487bb6cb3b8611191354052f34749" }, { "source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/backdrop-cms-before-1.35.1-information-disclosure-via-configuration-export-archive" } ], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-200" } ], "source": "disclosure@vulncheck.com", "type": "Primary" } ] } }
product	backdrop receipt Source NVD Its words `backdrop` Read by `field:cve.affected[].affectedData[].product` Said since 2026-10-03 06:07 UTC Last answered 2026-10-05 12:24 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "product": "backdrop", "vendor": "backdrop", "versions": [ { "lessThan": "1.35.1", "status": "affected", "version": "0", "versionType": "semver" }, { "status": "unaffected", "version": "1.35.1", "versionType": "semver" } ] } ], "source": "disclosure@vulncheck.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings." } ], "id": "CVE-2026-104476", "lastModified": "2026-10-03T00:16:35.747", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "disclosure@vulncheck.com", "type": "Secondary" } ] }, "published": "2026-10-03T00:16:35.747", "references": [ { "source": "disclosure@vulncheck.com", "url": "https://backdropcms.org/security/backdrop-sa-core-2026-006" }, { "source": "disclosure@vulncheck.com", "url": "https://github.com/backdrop/backdrop" }, { "source": "disclosure@vulncheck.com", "url": "https://github.com/backdrop/backdrop/commit/1ae67061d9d487bb6cb3b8611191354052f34749" }, { "source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/backdrop-cms-before-1.35.1-information-disclosure-via-configuration-export-archive" } ], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-200" } ], "source": "disclosure@vulncheck.com", "type": "Primary" } ] } }
status	Received receipt Source NVD Its words `Received` Read by `field:cve.vulnStatus` Said since 2026-10-03 06:07 UTC Last answered 2026-10-05 12:24 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "product": "backdrop", "vendor": "backdrop", "versions": [ { "lessThan": "1.35.1", "status": "affected", "version": "0", "versionType": "semver" }, { "status": "unaffected", "version": "1.35.1", "versionType": "semver" } ] } ], "source": "disclosure@vulncheck.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings." } ], "id": "CVE-2026-104476", "lastModified": "2026-10-03T00:16:35.747", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "disclosure@vulncheck.com", "type": "Secondary" } ] }, "published": "2026-10-03T00:16:35.747", "references": [ { "source": "disclosure@vulncheck.com", "url": "https://backdropcms.org/security/backdrop-sa-core-2026-006" }, { "source": "disclosure@vulncheck.com", "url": "https://github.com/backdrop/backdrop" }, { "source": "disclosure@vulncheck.com", "url": "https://github.com/backdrop/backdrop/commit/1ae67061d9d487bb6cb3b8611191354052f34749" }, { "source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/backdrop-cms-before-1.35.1-information-disclosure-via-configuration-export-archive" } ], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-200" } ], "source": "disclosure@vulncheck.com", "type": "Primary" } ] } }
vendor	backdrop receipt Source NVD Its words `backdrop` Read by `field:cve.affected[].affectedData[].vendor` Said since 2026-10-03 06:07 UTC Last answered 2026-10-05 12:24 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "product": "backdrop", "vendor": "backdrop", "versions": [ { "lessThan": "1.35.1", "status": "affected", "version": "0", "versionType": "semver" }, { "status": "unaffected", "version": "1.35.1", "versionType": "semver" } ] } ], "source": "disclosure@vulncheck.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings." } ], "id": "CVE-2026-104476", "lastModified": "2026-10-03T00:16:35.747", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary" } ], "cvssMetricV40": [ { "cvssData": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "source": "disclosure@vulncheck.com", "type": "Secondary" } ] }, "published": "2026-10-03T00:16:35.747", "references": [ { "source": "disclosure@vulncheck.com", "url": "https://backdropcms.org/security/backdrop-sa-core-2026-006" }, { "source": "disclosure@vulncheck.com", "url": "https://github.com/backdrop/backdrop" }, { "source": "disclosure@vulncheck.com", "url": "https://github.com/backdrop/backdrop/commit/1ae67061d9d487bb6cb3b8611191354052f34749" }, { "source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/backdrop-cms-before-1.35.1-information-disclosure-via-configuration-export-archive" } ], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-200" } ], "source": "disclosure@vulncheck.com", "type": "Primary" } ] } }

Text

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.