Admin Tools
Affected versions: < 7.9.0
Full advisory: our disclosure post
CVE-2026-105296MediumCVSS 5.1CVE published 4 November 2026Added to mySites.guru 4 November 2026
Admin Tools (com_admintools) below 7.9.0 - Cross-Site Request Forgery on some backend actions (admin must be tricked, low impact)
CVE-2026-105296 (published by the JPCERT/CC CNA on 4 Nov 2026, JVN#44272550): some Admin Tools backend actions did not check the anti-CSRF token. An attacker who tricks a logged-in Admin Tools administrator into visiting a malicious page could trigger one of those actions, for example running the temporary directory cleaner. No code execution, data read or account takeover is possible. Akeeba found and fixed this in its own security audit and shipped the fix in Admin Tools for Joomla 7.9.0 on 30 July 2026, months before the CVE was published. Update to 7.9.0 or later. Joomla 3 sites on Admin Tools 6.x have no fixed release on that line. CVSS 4.0 5.1 Medium.
Is my site affected?
CVE-2026-105296 is checked by 2 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| Admin Tools | before 7.9.0 | 7.9.0 | Update Admin Tools to 7.9.0 or later. |
| Akeeba Backup | before 10.3.7 | 10.3.7 | Update Akeeba Backup to 10.3.7 or later. |
How CVE-2026-105296 is scored
The base metrics as jpcert CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
5.1 Medium
CVSS 4.0, scored by jpcert CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:N Privileges required
- None. No account needed
- UI:A User interaction
- Active. Someone has to be talked through a few steps
What it does to the site
- VC:L Confidentiality
- Low. Some data can be read
- VI:L Integrity
- Low. Some data can be altered
- VA:N Availability
- None. The site stays up
What it does beyond the site
- SC:N Confidentiality
- None. Other systems keep their data
- SI:N Integrity
- None. Other systems keep their integrity
- SA:N Availability
- None. Other systems stay up
Timeline
- 4 November 2026CVE-2026-105296 record published by its CNA
- 4 November 2026mySites.guru check added for Admin Tools (before 7.9.0)
- 4 November 2026mySites.guru check added for Akeeba Backup (before 10.3.7)
- 4 November 2026We published: CVE-2026-105296: Akeeba Fixed These CSRF Gaps in July
Rule details
Akeeba Backup - Akeeba Backup (com_akeebabackup, com_akeeba) below 10.3.7 - Cross-Site Request Forgery on some backend actions (admin must be tricked, low impact)
CVE-2026-105296 (published by the JPCERT/CC CNA on 4 Nov 2026, JVN#44272550): some Akeeba Backup backend actions did not check the anti-CSRF token. An attacker who tricks a logged-in Akeeba Backup administrator into visiting a malicious page could trigger one of those actions, for example deleting an offsite copy of a backup archive whose ID they know. No code execution, data read or account takeover is possible, and current browsers' default SameSite cookie policy already blocked most of the actions. Akeeba found and fixed this in its own security audit and shipped the fix in Akeeba Backup for Joomla 10.3.7 on 30 July 2026, months before the CVE was published. Update to 10.3.7 or later. Joomla 3 sites on the legacy com_akeeba (Akeeba Backup 8.x and older) have no fixed release on that line; migrating to Joomla 4+ and current Akeeba Backup is the fix. CVSS 4.0 5.1 Medium.
Affected versions: < 10.3.7
Full advisory: our disclosure post
Our disclosure post
Other vulnerabilities in Admin Tools, Akeeba Backup and Akeeba Backup
Updating for CVE-2026-105296 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions.
Admin Tools
Latest safe version: 7.9.0
Akeeba Backup
Latest safe version: 10.3.7
Akeeba Backup
Latest safe version: 10.3.7
References
- CVE-2026-105296 on cve.org (the official CVE record)
- CVE-2026-105296 in the NIST National Vulnerability Database
- CVE-2026-105296: Akeeba Fixed These CSRF Gaps in July
CVE-2026-105296 questions
Which versions are affected by CVE-2026-105296?
CVE-2026-105296 is covered by 2 rules: Admin Tools before 7.9.0; Akeeba Backup before 10.3.7.
How do I fix CVE-2026-105296?
It depends on the extension and release line your site runs. For Admin Tools before 7.9.0: update Admin Tools to 7.9.0 or later. For Akeeba Backup before 10.3.7: update Akeeba Backup to 10.3.7 or later.
How severe is CVE-2026-105296?
jpcert CNA scores it 5.1 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and someone has to be talked through a few steps.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 4 November 2026.