CVE-2026-107848 Contao: Cross-site request forgery in custom backend actions
An attacker can trick authenticated backend users into executing state-changing actions via crafted URLs due to missing CSRF token validation on specific GET requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-107848?
CVE-2026-107848 is a low-severity vulnerability in contao, published on 9 Oct 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to modules available to that user, and the advisory demonstrates destructive or state-changing actions rather than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12.
Weakness: CWE-352
Which versions are affected by CVE-2026-107848?
4 open source packages ship an affected version, including contao/core-bundle.
| Package | Affected | Fixed in |
|---|---|---|
contao/core-bundle Packagist | From 4.0.0 | 5.3.50 |
contao/core-bundle Packagist | From 4.0.0 | 5.3.50 |
contao/core-bundle Packagist | From 5.4.0-RC1 | 5.7.12 |
contao/core-bundle Packagist | From 5.4.0-RC1 | 5.7.12 |
How do I fix CVE-2026-107848?
Upgrade contao/core-bundle to a fixed version for your release line: 5.3.50 or 5.7.12.
Is CVE-2026-107848 being exploited?
There is no known exploitation of CVE-2026-107848 in the wild and no public exploit code.
Sources
Also known as GHSA-9ff2-p842-45wq.