Skip to main content
mySites.guru
Free Audit
NewmySites.guru is now a Cloudflare verified serviceWhat it means for your sites

Akeeba Backup security vulnerabilities

mySites.guru tracks 1 vulnerability in Akeeba Backup (com_akeeba), covering 1 CVE. Every connected Joomla site is checked against it on each audit.

Is my site affected?

Your site is affected if it runs Akeeba Backup in this range:

  • before 10.3.7
Latest safe version
10.3.7 or later. No rule we check matches that release or any newer one.
What to do
Update Akeeba Backup to 10.3.7 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every Akeeba Backup vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2026-105296CVSS 5.1before 10.3.710.3.7Medium2026-11-04

What we check for

MediumCVE-2026-1052962026-11-04

Akeeba Backup (com_akeebabackup, com_akeeba) below 10.3.7 - Cross-Site Request Forgery on some backend actions (admin must be tricked, low impact)

CVE-2026-105296 (published by the JPCERT/CC CNA on 4 Nov 2026, JVN#44272550): some Akeeba Backup backend actions did not check the anti-CSRF token. An attacker who tricks a logged-in Akeeba Backup administrator into visiting a malicious page could trigger one of those actions, for example deleting an offsite copy of a backup archive whose ID they know. No code execution, data read or account takeover is possible, and current browsers' default SameSite cookie policy already blocked most of the actions. Akeeba found and fixed this in its own security audit and shipped the fix in Akeeba Backup for Joomla 10.3.7 on 30 July 2026, months before the CVE was published. Update to 10.3.7 or later. Joomla 3 sites on the legacy com_akeeba (Akeeba Backup 8.x and older) have no fixed release on that line; migrating to Joomla 4+ and current Akeeba Backup is the fix. CVSS 4.0 5.1 Medium.

Affected versions: < 10.3.7

Full advisory: our disclosure post

Timeline

  1. 11 March 2024We published: Backup 1000s of Sites from One Dashboard
  2. 11 March 2024We published: Unlimited Backup Schedules With Cron Syntax
  3. 19 October 2026We published: How to add exception for mySites.guru in Admin Tools
  4. 4 November 2026Check added for CVE-2026-105296 (before 10.3.7)
  5. 4 November 2026CVE-2026-105296 record published

What we have written about Akeeba Backup

How to add exception for mySites.guru in Admin Tools

How to add exception for mySites.guru in Admin Tools

Admin Tools' .htaccess Maker gives mySites.guru a 403 on Joomla until plugins/system/bfnetwork is in the right exception list. Which one, and why backups fail.

Backup 1000s of Sites from One Dashboard

Backup 1000s of Sites from One Dashboard

Schedule and manage Akeeba Backup across thousands of Joomla and WordPress sites from a single mySites.guru dashboard.

Unlimited Backup Schedules With Cron Syntax

Unlimited Backup Schedules With Cron Syntax

Create unlimited backup schedules in mySites.guru using cron syntax. Assign different Akeeba Backup profiles per schedule.

References

Each CVE page above links its official cve.org record and its NVD entry.

Akeeba Backup vulnerability questions

Which versions of Akeeba Backup are vulnerable?
mySites.guru tracks one vulnerability in Akeeba Backup (com_akeeba). A site is affected if its installed version is in this range: before 10.3.7.
What is the latest safe version of Akeeba Backup?
10.3.7. Every vulnerability tracked here is fixed by 10.3.7, and no rule we check matches that release or any later one.
How do I check which version of Akeeba Backup my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_akeeba. mySites.guru reads the installed version on every audit of a connected site and checks it against this rule.

Running Akeeba Backup on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-105296. Rules current as of 4 November 2026.