CVE-2026-107848 in Contao
Summary
by MITRE • 10/09/2026
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to modules available to that user, and the advisory demonstrates destructive or state-changing actions rather than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
Contao is a widely used open-source content management system that relies on server-side request handling to manage user interactions within its backend interface. The vulnerability identified affects Contao versions ranging from 4.0.0 through 5.3.50 and 5.7.12, specifically targeting the RequestTokenListener component responsible for enforcing Cross-Site Request Forgery protections. In a secure implementation, CSRF tokens are typically required to validate that state-changing requests originate from legitimate user sessions rather than malicious third-party sites or scripts. However, in these affected versions, the validation logic contains a critical flaw where it only enforces REQUEST_TOKEN validation strictly for POST requests. This creates an asymmetry in security enforcement across different HTTP methods used by the application.
The technical root cause lies in how GET requests are handled within the Contao backend architecture. The system employs a declarative guard mechanism that is designed to protect specific actions, but this guard only activates when the act parameter is present in the request. Crucially, backend actions dispatched through the key parameter bypass this protection entirely because they do not trigger the same validation checks as POST requests or GET requests with an act parameter. This architectural oversight allows authenticated backend users to execute state-changing operations via simple HTTP GET requests without providing a valid CSRF token. An attacker can exploit this by crafting malicious URLs that contain specific parameters designed to invoke these unprotected actions, relying on the victim user being logged into their Contao administrative session when they access or are redirected to the crafted link.
The operational impact of this vulnerability is significant for organizations using affected versions of Contao, particularly those with users who have elevated privileges in the backend environment. Since authenticated administrators often possess permissions to modify content, manage settings, delete records, and perform other destructive operations, an attacker can leverage these capabilities without authorization from a security token perspective. The advisory notes that while privilege escalation is not directly possible through this vector alone because reachable actions are limited by the user's existing module permissions, the ability to execute state-changing actions remains dangerous. This includes scenarios where an attacker could delete critical content, alter site configurations, or disrupt service availability by triggering destructive functions available to the targeted user role.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF), specifically highlighting a failure in validating request authenticity for certain HTTP methods and parameter combinations. From an offensive security perspective, such exploitation techniques are often categorized under ATT&CK technique T1076, known as Remote File Inclusion or more broadly within the context of web application attacks, it relates to unauthorized state changes via forged requests. The lack of consistent token validation across GET and POST methods represents a common misconfiguration pattern where developers assume that read-only operations like GET are inherently safe from CSRF, ignoring cases where GET parameters can trigger backend logic with side effects.
Mitigation for this issue requires immediate upgrading to Contao version 5.3.50 or 5.7.12 and later, as these releases contain the necessary patches to correct the RequestTokenListener behavior. Until an upgrade is feasible, administrators should consider implementing additional security controls such as strict Content Security Policy headers that restrict form submissions and potentially disabling unnecessary backend modules if they are not actively used. Furthermore, ensuring that all state-changing operations utilize POST requests with proper token validation can serve as a defensive workaround for legacy systems where patching is delayed. Organizations must also review their access control policies to ensure that the principle of least privilege is strictly enforced, minimizing the potential damage an attacker could cause even if they successfully exploit this CSRF weakness by limiting which actions are available to lower-privileged users in the backend interface.