Contao: Cross-site request forgery in custom backend actions

Low · CVSS 3.5

`RequestTokenListener` is the only generic `REQUEST_TOKEN` validator in Contao and it only runs on POST. On the GET side the guard is local and declarative, and it only fires when an `act` parameter is present. Every back end action dispatched through a different parameter therefore has no CSRF protection at all. This is a family rather than a single bug. ### Impact An attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation.

Remediation

Upgrade contao/core-bundle to 5.3.50 or later. Upgrade contao/core-bundle to 5.7.12 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-9ff2-p842-45wq

← All threats