CVE-2026-107848: Contao: Cross-site request forgery in custom backend actions

October 9, 2026

RequestTokenListener is the only generic REQUEST_TOKEN validator in Contao and it only runs on POST. On the GET side the guard is local and declarative, and it only fires when an act parameter is present. Every back end action dispatched through a different parameter therefore has no CSRF protection at all. This is a family rather than a single bug.

References

github.com/advisories/GHSA-9ff2-p842-45wq
github.com/contao/contao/commit/34dd27ee6739f10568d3d95d8784862255c925b4
github.com/contao/contao/releases/tag/5.7.12
github.com/contao/contao/security/advisories/GHSA-9ff2-p842-45wq
nvd.nist.gov/vuln/detail/CVE-2026-107848

Code Behaviors & Features

Detect and mitigate CVE-2026-107848 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →