CVE-2026-55824 Details
Description
Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony option names basic_auth and bearer_auth instead of Symfony HttpClient's real auth_basic and auth_bearer options. When contao.crawl.default_http_client_options contains Basic or Bearer authentication for a protected staging/production site, those credentials remain in the "clean" client used for external links or configured additional URIs. An attacker who can get an external URL crawled, for example through a link on a crawled page while the broken-link checker is enabled, can receive the crawler credentials. This issue has been fixed in versions 5.3.47 and 5.7.7.
A vulnerability exists in Contao's crawler functionality, specifically in versions 4.13.40 prior to 5.3.46 and 5.7.0-RC1 prior to 5.7.6. The issue arises because the crawler inadvertently transmits authentication credentials to external hosts. Although the crawler attempts to shield sensitive HTTP client options from being sent to outside domains by establishing a scoped client—full options for root page origins and cleaned options for others—the cleaning process fails to properly handle Symfony HttpClient's authentication options. Instead of removing the correct option names, it strips non-Symfony names, leaving real authentication credentials intact in the client used for external links. This flaw allows an attacker to capture these credentials by having an external URL crawled, particularly through a link on a page being crawled while the broken-link checker is active.
Users can update to Contao versions 5.3.47 or 5.7.7, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 31, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/contao/contao/security/advisories/GHSA-3mr9-p497-58f6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Contao | >= 4.13.40, <= 5.3.46 (semver) >= 5.7.0-RC1, <= 5.7.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | New CVE Received | [email protected] |