CVE-2026-107848 — Contao: CSRF in backend actions

What happened

Contao's RequestTokenListener validated REQUEST_TOKEN only for POST requests while the declarative GET guard ran only when an act parameter was present. Backend actions dispatched through the key parameter could therefore execute without a CSRF token if an authenticated backend user loaded an attacker-controlled URL. Reachable actions are limited to modules available to that user; the advisory demonstrates destructive or other state-changing actions rather than privilege escalation.

Technical cause

The vulnerability arises from inconsistent enforcement of CSRF checks: token validation applied only to POST requests, and the GET-side declarative guard only applied when an act parameter was present. Actions triggered via a different parameter (key) bypassed the GET guard, allowing state-changing backend operations to be invoked without a REQUEST_TOKEN when a backend user followed a crafted link.

Why this matters

An attacker who can cause an authenticated backend user to load a crafted URL may trigger state changes or destructive backend actions within the scope of that user's module privileges. The issue does not, in the available advisory material, represent unauthenticated remote access or direct privilege escalation, but it impacts integrity by enabling actions without a CSRF token.

Who is affected

Installs of contao/core-bundle in the vulnerable ranges are affected. The behavior requires an authenticated backend user — actions invoked are limited to the modules accessible to that user.

Discovery and timeline

Advisories and database entries publishing this issue appeared on 2026-10-09 (OSV/GitHub advisory entries). The NVD entry is published and referenced with a later modification timestamp on 2026-10-09. See the source advisories for full timestamps.

Affected versions

Sources describe the vulnerability affecting contao/core-bundle from 4.0.0 up to 5.3.50, and from 5.4.0-RC1 up to 5.7.12. Vendor fixes are provided in 5.3.50 and 5.7.12.

Fixes and mitigation

Vendor fixes are available; the issue is fixed in 5.3.50 and in 5.7.12. The published sources indicate updates as the remediation. The advisories do not list other compensating mitigations in detail.

Recommended action

Apply the vendor update to a fixed release — upgrade affected contao/core-bundle installations to 5.3.50 or 5.7.12 as appropriate for your deployment. Review backend module access and limit backend user exposure to untrusted links until systems are patched.