Core bundle: Contao: Cross-site request forgery in custom backend actions (CVE-2026-107848)

The vulnerability arises because Contao's generic CSRF token validator (RequestTokenListener) only runs on POST requests. GET requests that trigger backend actions via parameters other than 'act' (specifically 'key=') do not have CSRF protection. This design flaw means that any backend action dispatched through a 'key=' parameter can be executed by an attacker if a logged-in backend user loads a crafted URL. The impact is limited to the permissions of the authenticated user and does not include privilege escalation. The issue is systemic to the dispatch mechanism rather than a single callback, affecting all current and future 'key=' actions. The vulnerability has a CVSS 3.1 score of 3.5 (low severity) and is tracked as CWE-352 (Cross-Site Request Forgery).

An attacker can cause an authenticated backend user to perform unintended backend actions by tricking them into loading a malicious URL. These actions do not require a CSRF token or user confirmation. The impact is limited to the permissions of the authenticated user and does not include confidentiality loss or privilege escalation. Verified vulnerable actions are destructive or state-changing but do not grant additional privileges.

A patch is available for this vulnerability. Users should update Contao core bundle to a fixed version beyond 5.3.50 or 5.7.12 as appropriate. Until patched, users should avoid loading untrusted URLs while authenticated in the backend. No other vendor advisories indicate that no action is required or that the issue is already mitigated.