A CSRF vulnerability in the Salesforce module for Backdrop CMS may allow unauthorized actions to be performed on behalf of an authenticated user.

This is a CWE-352 Cross-Site Request Forgery (CSRF) vulnerability. It requires user interaction (e.g., a victim clicking a link) to perform unauthorized actions within the administrative context.

If successfully exploited, an attacker could trick an administrator into performing unintended actions, such as modifying configuration or exfiltrating data via the Salesforce module. While it requires user interaction, the potential for high-privilege misuse justifies the severity and necessitates prompt remediation.

Immediate Action: Update the Salesforce module for Backdrop CMS to version 1.x-1.0.1 or later.

Proactive Monitoring: Review administrative audit logs for any unexpected changes made to Salesforce module settings or integrations.

Compensating Controls: Encourage administrators to maintain active browser sessions only when necessary and avoid clicking untrusted links while logged into the CMS backend.

Public Exploit Available: No — there is no confirmed public weaponized exploit available.

While CSRF attacks require specific user interaction, the impact on administrative modules can be significant. Organizations utilizing the Salesforce module on Backdrop CMS should verify their version and apply the update to version 1.x-1.0.1 to eliminate this risk.