CVE-2026-107848: 
PHP vulnerability analysis and mitigation

CVE-2026-107848 is a Cross-Site Request Forgery (CSRF) vulnerability in Contao, an open-source CMS, affecting the backend action dispatch mechanism. The flaw exists in versions >= 4.0.0 and < 5.3.50, and >= 5.4.0-RC1 and < 5.7.12 of the contao/core-bundle Composer package. It was originally published on August 25, 2026, and added to the GitHub Advisory Database on October 9, 2026. The vulnerability carries a CVSS v3.1 base score of 3.5 (Low) (Github Advisory).

The root cause (CWE-352) lies in Contao's RequestTokenListener, which only validates the REQUEST_TOKEN on POST requests. The declarative GET-side CSRF guard only activates when an act parameter is present in the request. Backend actions dispatched via the key parameter — a separate dispatch mechanism — therefore bypass CSRF validation entirely on GET requests. An attacker can craft a malicious URL that, when loaded by an authenticated backend user, triggers state-changing backend actions (e.g., resending opt-in tokens, toggling debug mode) without any CSRF token. The fix, applied in commit 34dd27e, adds explicit CSRF token validation for key= actions, including checking the rt parameter and enforcing POST methods where appropriate (Github Advisory, Patch Commit).

Successful exploitation allows an attacker to perform destructive or state-changing backend operations on behalf of an authenticated Contao backend user without their knowledge or consent. The scope of reachable actions is bounded by the victim user's backend permissions — no privilege escalation has been identified. There is no confidentiality impact; the primary risk is unauthorized integrity modification of CMS backend state, such as triggering opt-in token resends or toggling debug mode (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering an authenticated backend user into loading an attacker-controlled URL, which limits practical exploitability.

1. Identify target: Confirm the target Contao instance is running a vulnerable version (>= 4.0.0, < 5.3.50 or >= 5.4.0-RC1, < 5.7.12) and identify a backend user with access to the desired module (e.g., opt-in management or debug toggle).
2. Identify vulnerable key= action: Enumerate available backend actions dispatched via the key parameter (e.g., ?do=opt_in&key=resend or ?do=debug&key=enable) that perform state-changing operations.
3. Craft malicious URL: Construct a GET request URL targeting the Contao backend with the desired key= parameter and any required record identifiers (e.g., https://target.example.com/contao?do=opt_in&key=resend&id=123). No CSRF token (rt) is required due to the missing validation.
4. Deliver URL to victim: Lure an authenticated backend user into loading the crafted URL via phishing, a malicious link, or an embedded resource (e.g., <img src="..."> in an email or webpage).
5. Action executes: The backend action fires in the context of the authenticated user's session, performing the state-changing operation without any token validation or user confirmation (Github Advisory).

• Logs: Contao backend access logs showing GET requests to backend URLs containing key= parameters (e.g., ?do=opt_in&key=resend, ?do=debug&key=enable) originating from unexpected IP addresses or referrers not matching the Contao backend domain.
• Network: HTTP GET requests to the Contao backend with key= parameters and no rt (CSRF token) query parameter, especially from external or unfamiliar referrer origins.
• Application Behavior: Unexpected state changes in the Contao backend, such as opt-in tokens being resent without user-initiated action, or debug mode being toggled unexpectedly.

Contao has released patched versions 5.3.50 and 5.7.12 that add explicit CSRF token validation for all key= backend actions. Administrators should upgrade to these versions or later immediately. As a defense-in-depth measure, consider implementing SameSite=Strict or SameSite=Lax cookie attributes to reduce CSRF risk, and restrict backend user permissions to the minimum necessary. Monitor backend activity logs for unexpected state-changing actions as an interim detection measure (Github Advisory, Patch Commit, Release 5.7.12).

The vulnerability was reported by HDWSec and published by Contao maintainer leofeyer on August 25, 2026. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (Github Advisory).