Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/CVE-2026-107848.md

Created October 10, 2026 20:30
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/f797a798bc89f290dbc7f5bab9510361 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/f797a798bc89f290dbc7f5bab9510361 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2026-107848: CVE-2026-107848: Cross-Site Request Forgery (CSRF) in Contao Backend Actions via GET Requests - CVE Security Report
Raw
CVE-2026-107848.md

CVE-2026-107848: CVE-2026-107848: Cross-Site Request Forgery (CSRF) in Contao Backend Actions via GET Requests

CVSS Score: 3.5 Published: 2026-10-09 Full Report: https://cvereports.com/reports/CVE-2026-107848

Summary

Contao Open Source CMS versions 4.0.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 contain a Cross-Site Request Forgery (CSRF) vulnerability in backend parameter handling. The RequestTokenListener component validates anti-CSRF tokens solely for HTTP POST requests, while GET-based declarative guards run only when an act parameter is present in the query string. Consequently, custom backend actions dispatched via alternative parameters such as key= can execute without CSRF token verification when triggered by an authenticated user.

TL;DR

Contao CMS fails to validate anti-CSRF tokens for custom backend GET actions using query parameters like key=. An attacker can trick an authenticated backend user into visiting a crafted URL to execute unauthorized state-changing operations within the user's permission scope.

Technical Details

  • CWE ID: CWE-352 (Cross-Site Request Forgery)
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 3.5 (Low)
  • EPSS Score: 0.00113 (1.34th percentile)
  • Impact: Low Integrity Impact (State-changing backend operations)
  • Exploit Status: None / No public functional exploit
  • CISA KEV Status: Not listed

Affected Systems

  • Contao Open Source CMS (contao/contao) >= 4.0.0, < 5.3.50
  • Contao Open Source CMS (contao/contao) >= 5.4.0-RC1, < 5.7.12
  • contao/contao: >= 4.0.0, < 5.3.50 (Fixed in: 5.3.50)
  • contao/contao: >= 5.4.0-RC1, < 5.7.12 (Fixed in: 5.7.12)

Mitigation

  • Upgrade Contao CMS to version 5.3.50, 5.7.12, or higher.
  • Enforce HTTP POST method on all custom state-changing DCA actions (key=).
  • Implement explicit ContaoCsrfTokenManager::isTokenValid() verification in custom controller handlers.
  • Configure backend session cookies with SameSite=Strict or SameSite=Lax attributes.

Remediation Steps:

  1. Run php composer.phar update contao/contao to pull the latest security fixes.
  2. Audit custom third-party extensions for GET-based backend actions using key= query parameters.
  3. Update custom DCA definitions to require 'method' => 'POST' for state-changing operations.
  4. Clear application cache and verify backend operation behavior.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment