Contao CMS CVE-2026-107848

Exploitation requires that a Contao backend user be actively authenticated (valid backend session) AND be socially engineered into loading an attacker-controlled URL in that browser - this is the mandatory limiting factor (UI:R). The specific weakness is that RequestTokenListener, the only generic REQUEST_TOKEN validator, runs on POST only, and the declarative GET guard fires solely when an 'act' parameter is present; therefore any backend action dispatched through a different parameter (notably key=) executes over GET with no CSRF token. Executable actions are further LIMITED to the modules/permissions the victim user already holds, and the advisory confirms only destructive/state-changing actions were verified - no privilege escalation. No special non-default configuration is needed; the flaw is in the default dispatch mechanism across all affected versions.

This is a genuinely low-priority issue despite being a 'family' of CSRF bugs. The NVD CVSS of 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) correctly reflects weak real-world risk: while the attack vector is network (AV:N) and complexity is low (AC:L), exploitation is gated by two hard preconditions encoded in the vector - the victim must already be an authenticated backend user (PR:L reflects this session dependency) and must actively load an attacker-controlled URL (UI:R). No EPSS score, KEV listing, or public exploit code was provided, so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. The vendor advisory is notably honest about scope: reachable actions are confined to modules the victim user can already access, and the researchers explicitly state they found NO privilege-escalating action - only destructive or state-changing ones. CONFLICT TO NOTE: the input Tags list 'Privilege Escalation', but the GHSA advisory directly refutes this ('We have not found a key= action that grants privileges'), so that tag appears mislabeled. Net: a real, well-documented CSRF design flaw worth patching on normal cadence, not an emergency.

An attacker crafts a malicious page or link embedding a Contao backend URL that invokes a state-changing action via a non-act dispatch parameter (e.g. key=). A currently-logged-in backend user who visits that URL unknowingly executes the action under their own session with no CSRF token or confirmation. No public exploit code was identified, but the dispatch-level nature of the flaw means any present or future key= action is reachable within the victim's module permissions.