Backdrop CMS Core versions 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles the token browser, allowing the selection of token types without sufficient restriction. This constitutes an improper access control flaw (CWE‑669) that could let an attacker retrieve or manipulate data beyond intended permissions, potentially exposing sensitive site content or facilitating further compromise.

The vulnerability affects Backdrop CMS, specifically core releases 1.35.x prior to 1.35.2 and 1.34.x prior to 1.34.6.

With a CVSS score of 7.5 the vulnerability carries a medium‑to‑high impact, and its EPSS score is not available while it is not listed in the CISA KEV catalog. Attackers would typically exploit the web‑based token browser, and no special prerequisites beyond normal site access are described. The lack of strict token‑type restrictions gives a broad attack surface for privilege escalation or data disclosure.