Security
Akeeba fixes Joomla CSRF flaws tracked as CVE-2026-105296
Akeeba fixed cross-site request forgery vulnerabilities in its Joomla extensions months before CVE-2026-105296 was published, but administrators still running older releases should update.
The issue affects Akeeba Backup for Joomla versions before 10.3.7 and Admin Tools for Joomla versions before 7.9.0. Akeeba released both fixes on 30 July 2026. The disclosure was published by mySites.guru and assigned a CVSS 4.0 score of 5.1, rated Medium.
The CSRF flaws could let an attacker induce a logged-in administrator to perform certain low-impact backend actions after visiting a malicious page. The report says the issues did not provide a route to code execution, data theft or account takeover. No exploitation has been reported by Akeeba, and the CISA assessment lists exploitation as none.
- Update
Akeeba Backup for Joomlato10.3.7or later. - Update
Admin Tools for Joomlato7.9.0or later. - Joomla 3 sites using the older 8.x or 6.x product lines should plan migration, as no fixed releases for those lines were identified.
Administrators who updated after July have already addressed this issue, but should continue using current releases.
Originally reported by mySites.guru.