CVE-2026-104059

Name of the Vulnerable Software and Affected Versions Lektor version 3.3.14 Lektor version 3.4.0b15

Description A cross-site request forgery (CSRF) issue exists in the admin API blueprint. This allows unauthenticated attackers to execute state-changing actions via cross-origin requests due to a lack of CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting. Attackers can use a malicious web page to target the 'newattachment', 'deleterecord', 'build', 'clean', and 'publish' endpoints to write arbitrary files, delete pages, wipe build output, and trigger deployment publication. Additionally, DNS rebinding—a technique used to bypass the Same-Origin Policy—can be used to access read endpoints and disclose data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.