CVE-2026-104059 is a high-severity vulnerability in Lektor 3.3.14 and 3.4.0b15 that allows unauthenticated attackers to perform state-changing actions via cross-origin requests without CSRF tokens or other security measures. This vulnerability affects Lektor users who have not updated to a patched version. The vulnerability is caused by a lack of CSRF tokens, Origin/Referer validation, CORS configuration, [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-28T00:18:12.530Z and has not been modified since then. The vulnerability exists in Lektor versions less than 3.3.14 on Windows, allowing attackers to read arbitrary files accessible to the process, potentially disclosing sensitive information such as system files and deployment configuration files c [truncated]
