Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.5

Contao backend actions can run without CSRF protection

CVE-2026-107848 · published 9 days ago
Summary

The Contao content management system lets certain admin functions be triggered just by visiting a crafted link, without requiring the usual safety token. An attacker could cause unwanted changes for any logged‑in admin who clicks the link. Update to the latest Contao version or apply the supplied patches to restore proper token checks.

What to do
  • Update contao core-bundle to version 5.3.50.
  • Update contao core-bundle to version 5.7.12.
Affected software
Ecosystem VendorProductAffected versions
composer contao core-bundle >= 4.0.0, < 5.3.50
>= 5.4.0-RC1, < 5.7.12
Fix: upgrade to 5.3.50
Original advisory text
Contao: Cross-site request forgery in custom backend actions
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to modules available to that user, and the advisory demonstrates destructive or state-changing actions rather than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.5 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published9 Oct 2026
Updated16 Oct 2026
First seen9 Oct 2026
Sources
CVE-2026-107848 · NVD
GHSA-9ff2-p842-45wq · GHSA
CVE-2026-107848 · OSV
Track software like this
Free during beta