CVE-2026-107848: Contao: Cross-site request forgery in custom backend actions
RequestTokenListener is the only generic REQUESTTOKEN validator in Contao and it only runs on POST. On the GET side the guard is local and declarative, and it only fires when an act parameter is present. Every back end action dispatched through a different parameter therefore has no CSRF protection at all. This is a family rather than a single bug.
Impact
An attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future key= action inherits it.
Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a key= action that grants privileges; the ones we verified are destructive or state changing rather than escalating.
Other sources
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to modules available to that user, and the advisory demonstrates destructive or state-changing actions rather than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/contao/core-bundleto a version that resolves this vulnerability.Fixed in 5.7.12 - Upgrade
Upgrade
composer/contao/core-bundleto a version that resolves this vulnerability.Fixed in 5.3.50 - Upgrade
Upgrade
Contaoto a version that resolves this vulnerability.Fixed in 5.3.50 - Upgrade
Upgrade
Contaoto a version that resolves this vulnerability.Fixed in 5.7.12
Event History
Frequently Asked Questions
Who can be affected by this issue?
An authenticated Contao backend user can be affected if they are induced to load an attacker-controlled URL. The impact is limited to backend modules and actions that the logged-in user is already permitted to access.
What must an attacker do to exploit it?
The attacker needs to cause an authenticated backend user to visit a crafted URL that dispatches an action through the key parameter. No CSRF token is required for those affected actions, but user interaction is required.
Are all Contao installations affected by default?
The issue affects versions from 4.0.0 through versions before 5.3.50 and before 5.7.12. Exploitability depends on an authenticated backend user having access to a reachable action and visiting the attacker-controlled URL.
What should be done if upgrading cannot happen immediately?
Limit backend access to trusted users and reduce exposure to attacker-controlled links or URLs for authenticated backend users. Review which backend modules and state-changing actions are available to those users.
How can I determine whether an installation is vulnerable?
Check the installed Contao version. Installations running 5.3.50 or 5.7.12 are fixed; versions beginning with 4.0.0 through releases before those fixed versions are affected.