CVE-2026-55824: 
PHP vulnerability analysis and mitigation

CVE-2026-55824 is a credential leakage vulnerability in Contao, an open-source CMS, where the built-in crawler inadvertently sends HTTP authentication credentials (Basic or Bearer) to external hosts. The flaw affects Contao versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, and was published on July 31, 2026. It was originally disclosed via a GitHub Security Advisory on June 15, 2026 by maintainer leofeyer. The vulnerability carries a CVSS v3.1 base score of 2.6 (Low) (GitHub Advisory).

The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) lies in a logic error in core-bundle/src/Crawl/Escargot/Factory.php. Contao's crawler creates a "scoped" HTTP client that is supposed to strip confidential options before making requests to external (non-root-page) hosts. However, the sanitization routine removes the incorrect option keys basic_auth and bearer_auth instead of Symfony HttpClient's actual option names auth_basic and auth_bearer. As a result, when contao.crawl.default_http_client_options is configured with Basic or Bearer authentication, those credentials persist in the "clean" client used for all external requests. An attacker who can cause the crawler to visit an attacker-controlled URL — for example, by inserting a link on a crawled page while the broken-link checker is active — will receive the Authorization header containing the leaked credentials. Additionally, the existing factory unit test failed to catch this because its mock client factory ignored the $defaultOptions argument (GitHub Advisory).

Successful exploitation results in the disclosure of crawler Basic or Bearer authentication credentials to an attacker-controlled external host. If those credentials protect a staging or pre-production environment, the attacker can use them to gain unauthorized access to that environment, potentially exposing unpublished content, configuration data, or other sensitive information. There is no direct integrity or availability impact, but the chain potential depends entirely on what the leaked credential unlocks in the protected environment (GitHub Advisory).

1. Reconnaissance: Identify a Contao site running an affected version (4.13.40–5.3.46 or 5.7.0-RC1–5.7.6) that has contao.crawl.default_http_client_options configured with auth_basic or auth_bearer credentials and has the broken-link checker or crawler enabled.
2. Gain content editing access: Obtain low-privilege access to the Contao backend (e.g., as a content editor) sufficient to add or modify page content.
3. Insert attacker-controlled URL: Add a hyperlink to an attacker-controlled server (e.g., https://attacker.example/probe) on a page that is within the crawler's scope.
4. Trigger crawler run: Wait for an administrator to manually start the broken-link checker, or for a scheduled maintenance task to trigger a crawler run.
5. Capture credentials: Monitor the attacker-controlled server's HTTP access logs for incoming requests containing the Authorization header, which will include the leaked Basic or Bearer credentials.
6. Leverage credentials: Use the captured credentials to authenticate against the protected staging or production environment they were intended to secure (GitHub Advisory).

• Network: Outbound HTTP requests from the Contao server to unexpected or attacker-controlled external domains containing an Authorization header during crawler or broken-link checker runs.
• Logs: Web server or application logs showing crawler-initiated requests to external URLs with Authorization: Basic ... or Authorization: Bearer ... headers present.
• Application Configuration: Presence of auth_basic or auth_bearer keys under contao.crawl.default_http_client_options in the Contao configuration, indicating credentials are in scope for leakage.
• Content: Newly added or recently modified links on crawled pages pointing to external or unfamiliar domains, particularly those added by low-privilege editor accounts (GitHub Advisory).

Contao has released patched versions 5.3.47 and 5.7.7, which correct the sanitization logic to strip the actual Symfony HttpClient option keys (auth_basic, auth_bearer, and defensively auth_ntlm) from the clean client, in addition to the previously (incorrectly) stripped basic_auth and bearer_auth. Administrators should upgrade to one of these versions immediately. As a temporary workaround prior to patching, remove any auth_basic or auth_bearer credentials from contao.crawl.default_http_client_options and disable the broken-link checker if crawler authentication is required (GitHub Advisory).

The vulnerability was disclosed responsibly by Contao maintainer leofeyer via a GitHub Security Advisory on June 15, 2026. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time.