CVE-2026-107848: Cross-Site Request Forgery (CSRF) in Contao Backend Actions via GET Requests

CVE-2026-107848 identifies a Cross-Site Request Forgery (CSRF) vulnerability in Contao Open Source CMS affecting versions 4.0.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11. The issue resides in the request listener and guard components responsible for anti-CSRF token verification across backend endpoints.

Contao relies on a dual-layer strategy for preventing cross-site request forgery: global request validation via RequestTokenListener and localized declarative route guards. However, RequestTokenListener was configured to validate the REQUEST_TOKEN parameter (rt) exclusively for HTTP POST requests, leaving HTTP GET requests unmonitored by default.

While declarative GET guards enforced token verification when the act parameter was present in the query string, custom backend actions dispatched via alternative parameters such as key bypassed these checks. Consequently, authenticated backend users who access external malicious URLs can inadvertently trigger state-changing operations within the context of their active sessions.

The root cause of CVE-2026-107848 stems from an incomplete CSRF token enforcement model in RequestTokenListener and route parameter validation. The framework's core request listener assumes that state-altering HTTP requests strictly utilize the POST method. Therefore, the listener bypasses token evaluation when processing HTTP GET requests.

To compensate for GET-based operations, Contao implemented localized declarative guards. These guards check for REQUEST_TOKEN validation specifically when the act query parameter is supplied (e.g., act=edit or act=delete). Operations defined through alternative keys, such as key=resend in tl_opt_in.php or administrative actions in DebugController, fail to invoke these guards.

Because the framework does not inspect query parameters outside the act namespace for anti-CSRF token validation during GET processing, an attacker can construct a cross-site GET link targeting a vulnerable module action. When an authenticated administrator or backend user accesses the crafted link, the handler processes the action under the victim's session privileges.

The remediation implemented in commit 34dd27ee6739f10568d3d95d8784862255c925b4 addresses the vulnerability across three architectural layers: Data Container Array (DCA) declarations, controller token checks, and backend navigation generation.

In DCA configurations like tl_opt_in.php, custom operations that were previously executable via GET requests were explicitly updated to require HTTP POST requests. This ensures that RequestTokenListener evaluates the anti-CSRF token automatically.

// Contao DCA configuration fix in tl_opt_in.php
'operations' => [
    'resend' => [
        'href' => 'key=resend',
        'icon' => 'resend.svg',
        // Added method enforcement to prevent GET-based execution
        'method' => 'POST',
    ]
];

Additionally, controller handlers such as DebugController and opt-in token re-issuance routines were updated to perform direct verification via ContaoCsrfTokenManager::isTokenValid(). BackendMenuListener was updated to inject valid rt query parameters into dynamic navigation elements, ensuring legitimate backend links pass verification.

Exploitation of CVE-2026-107848 requires an authenticated backend user to load an attacker-controlled URL or web page containing a cross-site GET request. The attack relies on social engineering or drive-by navigation to direct the victim to a malicious target.

<!-- Example CSRF exploit payload targeting key=resend endpoint -->
<img src="https://victim-contao.example.com/contao?do=opt_in&key=resend&id=123" width="1" height="1" alt="" />

When the victim loads a page hosting the payload above, the browser automatically sends ambient session cookies (ContaoBackendSession) to the target application. Because the request uses the GET method and lacks an act parameter, RequestTokenListener skips token validation and executes the underlying state-changing action.

The vulnerability does not grant full privilege escalation or arbitrary code execution directly. Reachable operations are strictly constrained to the module permissions and role privileges of the victim's session.

The security impact of CVE-2026-107848 is rated as Low severity under CVSS v3.1, with a base score of 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N). The vulnerability impacts data integrity within the boundaries of an authenticated backend session.

Because the flaw allows unauthenticated remote web pages to initiate backend actions on behalf of logged-in users, an attacker can trigger administrative side effects such as resending notification tokens or invoking debug routines. Confidentiality and availability remain unaffected.

The Exploit Prediction Scoring System (EPSS) assigns a probability score of 0.00113 (1.34th percentile), reflecting low likelihood of automated mass exploitation. No active exploitation in the wild or inclusion in the CISA KEV catalog has been observed.

The primary remediation for CVE-2026-107848 is upgrading Contao to fixed versions 5.3.50 or 5.7.12 or higher. Administrator teams should apply the update using Composer.

# Upgrade Contao core packages via Composer
php composer.phar update contao/contao

Developers maintaining custom Contao extensions or bespoke Data Container Arrays (DCA) must review custom operation declarations (key=). All state-changing endpoints should specify 'method' => 'POST' in DCA definitions or explicitly check tokens using ContaoCsrfTokenManager::isTokenValid().

> [!NOTE] > Deploying SameSite=Strict or SameSite=Lax configuration for backend session cookies provides defense-in-depth against cross-site GET request vectors across browser environments.