Executive brief
The Salesforce module for Backdrop CMS, which synchronizes data between the CMS and Salesforce, contains a security flaw in its authorization process. An attacker could trick a site administrator into performing unintended actions, potentially leading to the unauthorized linking of Salesforce accounts or data manipulation. This could compromise the integrity of customer data and business workflows integrated with Salesforce.
Technical details
The Salesforce module suite for Backdrop CMS fails to generate or validate a cryptographically random 'state' parameter during the OAuth authorization flow, leading to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to hijack the authorization process if they can trick a user with sufficient privileges into visiting a malicious link. Additionally, the OAuth callback endpoint is improperly exposed to a wide range of users, including potentially anonymous ones depending on configuration. An attacker could exploit this to link a malicious Salesforce account to the Backdrop site or intercept authorization codes. The issue is resolved in version 1.x-1.0.1.
Affected products
- Backdrop CMS Salesforce module < 1.x-1.0.1
Timeline
- 2026-04-29: advisory: Backdrop CMS security advisory BACKDROP-SA-CONTRIB-2026-001 published
- 2026-05-12: disclosed: CVE-2026-45430 published