CSRF in Lektor
CVE-2026-104059
Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting. Attackers can exploit the newattachment, deleterecord, build, clean, and publish endpoints from a malicious web page to write arbitrary files, delete pages, wipe build output, trigger deployment publication, and via DNS rebinding reach read endpoints to disclose data.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- gist.github.com/mansurmavlankulov/c7683e3204e84892e442b0196585d5bb (technical-description)
- www.vulncheck.com/advisories/lektor-csrf-via-admin-api-endpoints (third-party-advisory)
Frequently asked questions
- What is CVE-2026-104059?
- CVE-2026-104059 is a high-severity vulnerability in Lektor, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.1/10. Published 2026-10-01.
- How severe is CVE-2026-104059?
- High severity. CVSS v3 base score is 8.1 out of 10.