CVE-2026-107848 Details
Description
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to modules available to that user, and the advisory demonstrates destructive or state-changing actions rather than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12.
A cross-site request forgery (CSRF) vulnerability has been identified in Contao, an open-source content management system. This issue affects versions 4.0.0 through 5.3.50 and 5.7.12. The vulnerability arises because the RequestTokenListener only validates CSRF tokens for POST requests. For GET requests, the protection is limited and only activates when an 'act' parameter is present. As a result, backend actions triggered through the 'key' parameter can be executed without a CSRF token. This occurs when an authenticated backend user visits an attacker-controlled URL. The vulnerability allows actions to be performed within the modules accessible to the user, potentially leading to destructive or state-changing consequences, although it does not facilitate privilege escalation.
Users can upgrade to Contao versions 5.3.50 or 5.7.12 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/contao/contao/commit/34dd27ee6739f10568d3d95d8784862255c925b4 | [email protected] | Source CodeVendor |
| https://github.com/contao/contao/releases/tag/5.7.12 | [email protected] | Release NotesVendor |
| https://github.com/contao/contao/security/advisories/GHSA-9ff2-p842-45wq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Contao | >= 4.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |