CVE-2026-107848

Executive Summary

CVE-2026-107848 is a cross-site request forgery (CSRF) weakness in Contao, an open-source content management system, affecting versions from 4.0.0 up to (but not including) 5.3.50 and 5.7.12. The flaw arises because the RequestTokenListener validates the REQUEST_TOKEN only for POST requests, while the declarative GET guard executes only when an act parameter is present — allowing backend actions dispatched through the key parameter to run without a CSRF token. Successful exploitation requires an authenticated backend user to load an attacker-controlled URL, giving an attacker the ability to trigger destructive or state-changing actions within the modules that user can access; the CVSS score of 3.5 reflects low confidentiality and availability impact but limited integrity impact and a requirement for user interaction.

Technical Analysis

The vulnerability is a classic CSRF protection gap in Contao's request-handling layer. Two distinct defensive mechanisms exist and, critically, they do not overlap for the affected request shape:

1. POST-only token validation: RequestTokenListener checks the REQUEST_TOKEN parameter only when the incoming HTTP method is POST. Any request using the GET method bypasses this check entirely.
2. Conditional GET guard: A separate declarative GET guard is executed only when an act parameter is present in the request. Backend actions that are dispatched via the key parameter, rather than act, therefore do not trigger this guard.

The intersection of these two conditions creates a gap: a GET request that carries a key parameter (and no act parameter) is neither token-validated (because it is not POST) nor caught by the GET guard (because act is absent). An attacker who can cause an authenticated backend user to issue such a request can invoke backend actions without any CSRF token.

The reachable action surface is bounded by the privileges of the victimized backend user — only modules that user is authorized to access can be invoked. The advisory explicitly frames the demonstrated impact as destructive or state-changing actions rather than privilege escalation, which is consistent with the CVSS integrity-only impact (I:L) and the absence of confidentiality or availability impact in the vector.

The root cause maps directly to CWE-352 (Cross-Site Request Forgery): the application fails to enforce an anti-CSRF token on a state-changing request path because the enforcement is scoped to the wrong HTTP method and the wrong parameter name.

Note: The NVD description does not disclose the full list of affected modules, the specific key-dispatched actions demonstrated, or code-level line references. Claims beyond those stated should be treated as unverified until the upstream advisory is reviewed.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-107848. The attack chain below is inferred strictly from the vulnerability class (CSRF) and the details in the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Contao installation in the vulnerable version range (4.0.0 through 5.3.49 and 5.7.0 through 5.7.11). Because exploitation requires an authenticated backend session, the attacker must either know or induce a logged-in backend user to visit a crafted page, or target a user who typically keeps an active backend session.

2. Triggering the flaw class. The attacker crafts a URL that issues a GET request to a backend action dispatched through the key parameter, deliberately omitting the act parameter. Because the request is GET, RequestTokenListener does not validate REQUEST_TOKEN; because act is absent, the declarative GET guard does not run. The request therefore reaches the backend action without a CSRF token.

3. Payload / execution method. The attacker delivers the crafted URL to the authenticated backend user — for example, by embedding it as a link, image source, or iframe in a page the user is likely to load while logged in. When the user loads the attacker-controlled URL, their browser automatically sends the session cookie, and the backend action executes under the victim's identity. The candidate actions are limited to those dispatched via the key parameter and available to that user's role/module permissions.

4. Post-exploitation impact. The action performs a destructive or state-changing operation within the victim's authorized modules — for example, altering or removing content. The advisory does not demonstrate privilege escalation, confidentiality breach, or denial of service; impact is bounded to integrity changes reachable by the victim user's permissions.

Impact Assessment

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N (score 3.5) sets the impact profile precisely:

• Attack Vector (Network): The crafted URL is delivered remotely over the web.
• Attack Complexity (Low): No special conditions beyond a victim interaction are needed to trigger the flaw.
• Privileges Required (Low): The attacker needs an authenticated backend user to be the request originator; the attacker itself does not need backend credentials.
• User Interaction (Required): The authenticated user must load the attacker-controlled URL.
• Scope (Unchanged): Impact stays within the security authority of the vulnerable component.
• Confidentiality / Availability (None): No data disclosure or service disruption is described.
• Integrity (Low): Some backend state can be changed or destroyed within the victim's module permissions.

Business impact: For organizations running Contao as a public-facing CMS, the primary risk is unauthorized modification or destruction of backend-managed content by an attacker who lures an authenticated administrator or editor into loading a malicious URL. Because the action surface is limited to the victim's own permissions and no privilege escalation is demonstrated, blast radius is constrained — but integrity of published content and CMS configuration reachable via key-dispatched actions is at risk. EPSS has not yet scored this CVE, and it is not in CISA KEV, so there is no current evidence of mass exploitation or active in-the-wild campaigns.

Detection Guidance

Sigma Rule

title: Possible Contao CSRF via key Parameter Without act Parameter (CVE-2026-107848)
id: 3b7c9f21-5a4e-4d0c-9e11-8f2a6c1d4b77
status: experimental
description: Detects GET requests to Contao backend that use the key parameter without the act parameter, matching the CSRF token bypass condition.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107848
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'GET'
  selection_key:
    cs-uri-query|contains: 'key='
  filter_act:
    cs-uri-query|contains: 'act='
  condition: selection_method and selection_key and not filter_act
falsepositives:
  - Legitimate administrative navigation using key-based routing without act
level: low
tags:
  - attack.t1190
  - cwe.352

YARA Rule

rule CVE_2026_107848_Contao_CSRF_Key_Param
{
    meta:
        description = "Detects Contao request handling referencing key dispatch and REQUEST_TOKEN validation for CVE-2026-107848 triage"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107848"
        date = "2026-01-01"
        severity = "low"

    strings:
        $a = "RequestTokenListener" ascii wide nocase
        $b = "REQUEST_TOKEN" ascii wide nocase
        $c = "RequestTokenListener" ascii wide nocase

    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107848 Contao CSRF key parameter without act parameter"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"key="; http.uri; content:"act="; nocase; negate; reference:cve,2026-107848; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-107848; classtype:attempted-admin; sid:2026107848; rev:1;)

Elastic Detection

network where network.protocol == "http" and http.request.method == "GET" and
  stringContains(url.query, "key=") and not stringContains(url.query, "act=")

Splunk SPL Query

index=web sourcetype=access_combined method=GET
| where match(uri_query, "(?i)(\?|&)key=") AND NOT match(uri_query, "(?i)(\?|&)act=")
| stats count values(uri_path) as paths by src_ip, uri_query
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-107848,">
  <rule id="2026107" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <field name="protocol">GET</field>
    <match>key=</match>
    <regex negate="yes">act=</regex>
    <description>CVE-2026-107848: Possible Contao CSRF - GET request with key parameter and no act parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_107848,csrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). The only cited patch source is the GHSA advisory; treat the fix versions as unverified until confirmed against the vendor's own release notes.

1) Immediate mitigations

• Upgrade Contao installations to 5.3.50 or 5.7.12, per the GHSA advisory, as the primary remediation.
• Until upgrades can be scheduled, restrict access to the Contao backend by IP allowlisting or placing it behind a VPN/zero-trust proxy so attacker-controlled URLs cannot be reached by a logged-in backend user from external origins.
• Enforce short backend session lifetimes and aggressive session expiration to reduce the window in which a logged-in user can be induced to load a crafted URL.
• Consider a reverse-proxy or WAF rule that rejects GET requests to backend endpoints carrying a key parameter without an act parameter.
• Train backend users not to follow unsolicited links while authenticated and encourage closing the backend session when idle.

2) Patch / upgrade steps

• Back up the installation and database.
• Follow the Contao upgrade path to 5.3.50 (LTS branch) or 5.7.12 (current branch), applying the vendor's documented update procedure.
• Re-verify that the GHSA advisory's stated fix versions are consistent with what the vendor actually publishes before closing remediation tickets.
• After upgrading, re-test backend actions that are dispatched via the key parameter to confirm token enforcement now applies.

3) Long-term hardening

• Adopt uniform CSRF token enforcement across all state-changing HTTP methods (not just POST) to eliminate method-scoped bypasses.
• Ensure that declarative request guards apply regardless of parameter names (act vs key) so no single dispatch parameter escapes validation.
• Integrate dependency and version monitoring to track Contao releases and advisories, and include backend CSRF tests in the CI pipeline.
• Apply least privilege to backend roles so that, even if a CSRF action succeeds, the set of reachable destructive actions is minimal.

References

• NVD — CVE-2026-107848: https://nvd.nist.gov/vuln/detail/CVE-2026-107848
• GitHub Security Advisory (GHSA) — Contao CSRF bypass in RequestTokenListener (patch source cited; single-source claim)
• Contao official project site and release notes: https://contao.org
• CWE-352 — Cross-Site Request Forgery (CSRF): https://cwe.mitre.org/data/definitions/352.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No public proof-of-concept, exploit code, Nuclei template, or in-the-wild exploitation evidence is currently known for CVE-2026-107848. The CVE is not listed in CISA KEV, and EPSS has not yet assigned a score.