CVE-2026-107848

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to modules available to that user, and the advisory demonstrates destructive or state-changing actions rather than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12.

• CWE-352

• https://github.com/contao/contao/commit/34dd27ee6739f10568d3d95d8784862255c925b4
• https://github.com/contao/contao/releases/tag/5.7.12
• https://github.com/contao/contao/security/advisories/GHSA-9ff2-p842-45wq

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107840yopass is a service for securely sharing secrets, passwords,…7.5
• CVE-2026-107841pacioli provides least-privilege governance and a governed a…5.7
• CVE-2026-107842Contao is an Open Source CMS. From version 4.0.0 until 5.3.5…5.3
• CVE-2026-107843Contao is an Open Source CMS. From version 4.1.0 until 5.3.5…5.3
• CVE-2026-107844Contao is an Open Source CMS. From version 5.0.0 until 5.3.5…5.3
• CVE-2026-107845Contao is an Open Source CMS. From version 4.0.0 until 5.3.5…9.3
• CVE-2026-107850Contao is an Open Source CMS. From version 5.7.1 until 5.7.1…4.3
• CVE-2026-107851Contao is an Open Source CMS. From version 5.7.0 until 5.7.1…4.3
• CVE-2026-107852Jexactyl is a customisable game management panel and billing…7.1
• CVE-2026-107854Jexactyl is a customisable game management panel and billing…5.4
• CVE-2026-107856CiviForm simplifies applications for government benefits pro…4.5
• CVE-2026-107857Mindwtr is a free offline-first task management application …4.4