CSRF Vulnerability in Contao CMS Affects Multiple Versions
CVE-2026-107848
3.5LOW
What is CVE-2026-107848?
In Contao CMS versions ranging from 4.0.0 to 5.3.50 and 5.7.12, the RequestTokenListener improperly validates the REQUEST_TOKEN for POST requests. As a result, backend actions can be executed without a valid CSRF token when an authenticated user accesses a maliciously crafted URL. Although the scope of affected actions is limited to what the user can access, this vulnerability could potentially allow an attacker to perform unwanted changes within the application's backend if exploited. The issue has been addressed in the updated releases 5.3.50 and 5.7.12.
Affected Version(s)
contao >= 4.0.0, < 5.3.50 < 4.0.0, 5.3.50
contao >= 5.4.0-RC1, < 5.7.12 < 5.4.0-RC1, 5.7.12