CVE-2026-107848: Contao Core Bundle Cross-Site Request Forgery Vulnerability
Summary
CVE-2026-107848: Contao: Cross-site request forgery in custom backend actions. Affects contao/core-bundle across 2 version ranges.
>= 4.0.0, < 5.3.50
>= 5.4.0-RC1, < 5.7.12
Fixed in 5.3.50 or 5.7.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Contao is an open-source content management system (CMS) that allows users to create and manage websites easily. It provides a flexible framework with a user-friendly interface, making it suitable for both developers and non-technical users. The Contao Core Bundle is a key component of this CMS, responsible for backend functionalities. However, it is vulnerable to a cross-site request forgery (CSRF) issue that can be exploited if not addressed promptly.
Vulnerability Detail
The vulnerability arises from the RequestTokenListener, which is the only generic REQUEST_TOKEN validator in Contao, operating solely on POST requests. The GET requests lack adequate CSRF protection, as the guard mechanism is local and only activates when an act parameter is present. This oversight allows attackers to perform backend actions without any token or confirmation if they can trick a logged-in user into loading a malicious URL. The impact is limited to actions that the authenticated user can access, but it poses a significant risk as it can lead to destructive or state-changing actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 5.3.505.3.50composer require contao/core-bundle:5.3.50 -
>= 5.4.0-RC1, < 5.7.125.7.12composer require contao/core-bundle:5.7.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that backend users are educated about the risks of clicking on untrusted links and consider implementing additional security measures such as two-factor authentication to mitigate potential exploitation.
Conclusion
The identified CSRF vulnerability in the Contao Core Bundle poses a risk to backend users, allowing unauthorized actions if exploited. It is crucial to update to the latest patched versions to ensure the security of your application. Additionally, employing best practices in user education and security measures can help mitigate potential risks.
See every vulnerability recorded for contao/core-bundle →
FAQ
The vulnerability is a cross-site request forgery (CSRF) issue that allows attackers to perform unauthorized actions in the backend of Contao.
Any user of the Contao Core Bundle versions prior to the patched versions (5.3.50 and 5.7.12) is at risk if they are logged into the backend.
An attacker could perform actions on behalf of a logged-in user, potentially leading to data loss or unauthorized changes within the CMS.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 3.5, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
