Backdrop CMS EUVD-2026-101813

Exploitation requires access to Backdrop CMS Core's token browser feature - the interface used for selecting tokens such as [node:title] or [user:name] - on an affected version (1.35.x before 1.35.2 or 1.34.x before 1.34.6). The flaw manifests specifically because the token browser fails to restrict which token *types* are presented; the individual token names remain protected, which inherently limits the sensitivity of what can be disclosed. The practical limiting factor is reachability of the token browser: this control is normally embedded in content-authoring/configuration screens, so despite the input vector's PR:N, real exploitation most likely requires at least an authenticated low-privilege account rather than anonymous access. No special non-default configuration is indicated by the advisory, but the exact privilege requirement should be confirmed against Backdrop SA-CORE-2026-009.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 HIGH) frames this as a remotely exploitable, unauthenticated, low-complexity confidentiality breach. However, these signals are in tension with the description, which states only that the token browser exposes the *types* of tokens available while 'the names of the individual tokens are adequately protected.' That is a metadata/information-disclosure issue of limited sensitivity, which makes the C:H rating look inflated - leaking which token categories exist is far less severe than leaking token values or underlying data. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided intelligence, so there is no evidence of active or imminent exploitation. The PR:N (unauthenticated) claim should also be verified: token browsers in CMS platforms are typically surfaced inside content-editing or configuration UIs that normally require an authenticated session, so real-world access may require at least low privileges. Net judgment: this is a genuine but low-to-moderate real-world risk - a high-CVSS-but-lower-actual-impact information disclosure - that warrants routine patching rather than emergency response. CONFLICT TO VERIFY: CVSS C:H vs. a description that limits disclosure to token type categories, and PR:N vs. a feature that likely sits behind the authenticated editing interface.

An attacker who can reach the Backdrop CMS token browser requests the token selection interface and enumerates the full set of token *types* that the product exposes, beyond those it should present in that context. This reveals structural metadata about the site's entities and available dynamic data, though the individual token names themselves remain protected. No public proof-of-concept is available, and given AC:L the interaction is a simple request rather than a complex multi-step exploit.